So I recently installed Cachyos and I am now met with this problem.

There are kind of 2 main contenders here and I'm split between them. What do you use?

There is pacman + aur and then there is flatpak. Pacman has deep system integration and is much more lightweight but it has deep system integration and requires sudo to install. flatpak has sandboxing and easy permission management but it's bloated and possibly less performant?

Of course if the package isn't available on flathub then I will have to use the aur but when both are available it's hard to decide.

top 62 comments

sorted by: hot top controversial new old
[–] 18 points 7 months ago (1 child)

I use yay, as it comes by default with EndeavourOS. It's basically an AUR helper that uses pacman and works quite the same.

Flatpak is a different package manager and has nothing to do with your system packages. They are not exclusive, I use both. So what you basically asking isn't which package manager people use, but rather which package format.

  • source
  • hideshow 1 child comment
  • [–] 3 points 7 months ago

    Same here, I tried a number of arch derivatives and arch as well when I got a new desktop last year (after many years of mac work computers, iMac desktop for my kids, mostly Alpine images in the cloud/on k8s, and many many years of mostly Debian and fedora derivatives before I had kids and had time to putter around with *nix). Endeavor suited my needs (some local LLM stuff, personal browsing, a few OSS projects, and Steam) and yay has generally worked great to bridge the gap between pacman and aur.

  • source
  • parent
  • [–] 25 points 7 months ago (2 children)

    Pacman plus the AUR is the move on Arch based distros. The AUR gives you access to basically everything, and paru or yay handles the build chain without pain. Flatpak has its place for apps that ship messy runtime dependencies, but for most things it adds an unnecessary isolation layer. Have you tried paru as your AUR helper yet?

  • source
  • hideshow 2 child comments
  • [–] 17 points 7 months ago

    I sometimes prefer Flatpak over AUR, because I do not trust everyone on the AUR to run scripts with root rights on my system. At least Flatpaks are a bit sandboxed (even if the sandbox is an illusion) and the programs don't install and run with root rights. Sometimes the Flatpak is from the original developer and the script in AUR is not. Or the AUR script is not updated well and often enough, unlike day one Flatpak updates. But Flatpaks do not integrate well in your system and applications can look out of place too. There is a lot to consider, besides what you already mentioned.

    I use both, prefer the AUR in optimal cases.

  • source
  • parent
  • [–] 12 points 7 months ago

    I don't like Flatpak, so that makes it an easy choice for me. Flatpak apps never quite integrate properly

    I like having Flatpaks as a fallback option, but if something is available in the arch repos, aur or chaotic-aur, I'll always go there first

  • source
  • [–] 8 points 7 months ago
    [–] 7 points 7 months ago

    You can choose between things like flatpak or aur packages, but you're gonna have to use pacman either way, since your core packages are still managed by pacman even if you decide to install most things through flatpak. Just wanted to point that out in case you were thinking of not using it at all anymore, cause it's definitely not good to have your system get extremely out of date overtime. Having said that, it's a matter of preference. The aur has more packages available, but flatpak has verified packages available, so assuming you stick to those, it could be safer. It also offers things like sandboxing. When i was on arch i only used the aur. I usually go with whatever has the most packages available or whatever is most convenient.

  • source
  • [–] 7 points 7 months ago* (last edited 7 months ago) (8 children)

    Yay.

    And btw, that question is covered already.

  • source
  • hideshow 8 child comments
  • [–] 1 point 7 months ago* (last edited 7 months ago) (7 children)

    You mean you have a package manager for your system without a password? Why would anyone want that?

    Edit: For context. The part I was replying to was edited out.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 4 points 7 months ago* (2 children)

    (I can't see the edited out part but if it was about yay...)

    Yay builds in your local cache and then when it is ready to install it asks for sudo. The reason for this is because sudo can timeout during long builds, and more importantly if you compile with sudo you run the risk of arbitrary code execution. So it is safer to run with just yay and then it will ask for sudo when it actually needed.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 7 months ago

    No, that is not what it was about. I know, don't run sudo yay, but rather just yay and wait for password request. What it was is about a configuration to not ask password anymore, a passwordless package manger.

  • source
  • parent
  • load more comments (1 reply)
  • [–] 2 points 7 months ago* (3 children)

    Convenience. It asks the kernel if you're logged in and if you're allowed to escalate. So, secure enough for a single-user system.

    https://github.com/illiliti/ssu

  • source
  • parent
  • hideshow 3 child comments
  • [–] 3 points 7 months ago (2 children)

    I don't feel safe doing so. Would a script be able to run escalated rights without asking me a password? Is it somewhere displayed that such a process is started (notification in example or at least in the terminal a message?). And even for applications I am directly starting, I want it be explicit to require a password, that I am always aware its escalated root rights the app has now.

    I can understand your view of convenience and I am "guilty" of some convenience stuff too. But this goes a bit too far for my taste.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 6 points 7 months ago (3 children)

    I use an unholy blend of paru, Flatpak, Docker and AppImage apps (no Snap!) with Topgrade to update it all.

  • source
  • hideshow 3 child comments
  • [–] 6 points 7 months ago

    Personally, I use pacman when possible and flatpak when it's not. I try to avoid the aur as I have had too many problems with missing dependencies or version conflicts. Plus, I don't generally need things that are not in the repositories so it rarely comes up.

    "But flatpaks are not lean!" While this is true, I find flatpaks don't break my system. Flatpaks do use more resources, from storage to RAM, but I have plenty of both so it's not really a concern.

  • source
  • [–] 14 points 7 months ago (11 children)

    Your question is not Arch specific, it's "should I use flatpaks?" And the answer in my opinion is probably no.

    Flatpaks are a good idea to isolate certain applications and to provide a uniform way of installing packages. So there might be some apps that are not available in your native package manager, but do provide flatpaks. For those cases flatpaks are probably preferred. But Arch based distros have the AUR, so there are a lot of apps that aren't packaged for Arch that you can still get as a native package. Sure, using the AUR is risky and if you're not on actual Arch things might break sporadically because of mismatched dependencies (although I think CachyOS is full parity of packages with Arch, so that's maybe more of a Manjaro warning).

    But flatpaks are clunky, bloated, require annoying permissions to be set to do basic things, and require you to update two package managers to do a full system update. They are more appealing for systems where you don't want to give users root access but still allow them to install programs, but for your own computer I have never seen the appeal.

  • source
  • hideshow 11 child comments
  • [–] 2 points 7 months ago (5 children)

    I partially disagree. I have found that some flatpaks are better than otherwise for updating the app. When I use the air branch of discord on arch, discord does not update automatically and I need to complete a system upgrade and modify a Jason file. The flatpak version updates automatically with no problems.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 1 point 7 months ago (4 children)

    What is the air branch? Discord has a package on pacman, so it should just get updated with your normal system update, there's no config or anything that could prevent that, pacman doesn't care. What JSON do you have to edit and why?

  • source
  • parent
  • hideshow 4 child comments
  • [–] 2 points 7 months ago* (3 children)

    Build_info.json

    I have only ever had this issue with discord on arch. Whenever discord has an update, it will not fetch the update, but it tells me that an update can be downloaded.

    This is the situation with discord through aur. https://karx.xyz/blog/discord/

    I do not know the air branch

    Also, I am trying to convince my friends to switch to element instead of discord, but they have been stubborn.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 7 months ago (2 children)

    I have only ever had this issue with discord on arch.

    The issue you describe is not Arch specific and it's not an issue. Using a package manager means using a program to manage your packages. Things can't auto-upgrade, that breaks the point of a package manager.

    Whenever discord has an update, it will not fetch the update, but it tells me that an update can be downloaded.

    Of course, if you install discord through pacman, then pacman manages the update.

    As for the JSON file that's a very hacky approach, discord shouldn't outright fail to launch if there is an update. And in fact the Arch wiki says it has a flag to skip the version check completely:

    To disable the update check, add the line "SKIP_HOST_UPDATE": true to ~/.config/discord/settings.json. If the file does not exist, create it and add the following:

    ~/.config/discord/settings.json

    {
      "SKIP_HOST_UPDATE": true
    }
    

    More info on https://wiki.archlinux.org/title/Discord

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 7 months ago (1 child)

    The flatpak version of discord is able to fetch for updates when launching the app without needing to system update. And for some reason it is specifically on a system update. Updating only discord does not update the version even after modifying the build_info.json. and I could disable updates, but that shouldn't be necessary unless discord is pushing updates that are actively making the experience worse.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 7 months ago

    You're completely missing the point. Discord is a chat app, not a package manager, therefore it should NOT update things EVER. You're complaining that discord tries to do something it shouldn't, fails and somehow you seem to think that's pacman's fault.

    The "issue" doesn't exist on flatpaks because discord probably checks if it's installed via flatpak and runs an update using the flatpak command without your say so. The "solution" is to stop discord from trying to be "smart" and failing and let it be updated when pacman decides to.

    The idea of a package manager is to let it manage your packages, if you want self-updating apps you don't need a package manager, and good luck with dependencies and overlapping libraries.

  • source
  • parent
  • [–] 1 point 7 months ago (2 children)

    I usually use the pacman repo and if it's not in there decide for this specific app if I use the AUR or flatpak version

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 7 months ago (1 child)

    Yup, that sounds like a good approach. I could even see people doing Pacman -> Flatpaks -> AUR and it would make sense to me.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 7 months ago

    This is my approach. I use pacman where I can, flatpaks when something is unavailable, and AUR to get everything not available in the first two, or when a native package is preferred but isn't in the Arch repos.

  • source
  • parent
  • [–] 5 points 7 months ago (2 children)

    Look into the Chaotic AUR. It offers pre compiled AUR programs. Almost every app I really need has been there. If it's not in there and I really need it and will get used often I'll get it from the AUR.

    I dont really like flatpaks much. I'll use it if it's easy and I dont plan on using the app much. Apps like Bottles. They are nice to have but rarely do I use it.

  • source
  • hideshow 2 child comments
  • [–] [S] 2 points 7 months ago (1 child)

    Why would you download precompiled AUR binaries? it just seams more stable and secure to compile yourself, with this your trusting a third party when you didn't have to.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 7 months ago

    For me it's convenience, i try to not have a bunch of aur packages. Some big packages can take a good while to compile.

    Chaotic is also trying to combat threats by reviewing packages from maintainers that are not in their trust database. While not absolutely perfect at least they are trying to do something.

    The aur is a use at your own rick batch of packages. Last year there were some malicious packages running wild. AUR expects the user to do their own due diligence and do you really have time to read every bit of code you are about to install for every update in all the possible languages they could be written in? This is why I try to limit my dependence on the aur if possible chaotic or otherwise.

  • source
  • parent
  • [–] 5 points 7 months ago

    Always use native pkgs if possibile (so use pacman/paru)

    🎯 1
  • source
  • [–] 4 points 7 months ago (4 children)

    What do you mean by "bloated"? How many more bytes does the flatpak version have compared to its counterpart?

  • source
  • hideshow 4 child comments
  • [–] 8 points 7 months ago* (1 child)

    Depends on the program, they don't use system libraries so if they have a lot of dependencies then they'll be larger.

    An example:

    Steam Flatpak: 35MB

    Steam pacman: 19MB

    On one hand, it's only a few MB. On the other hand, it's 54% larger.

    Flatpaks can also depend on other flatpaks. For example, graphics card support requires about 1-1.5GB of flatpak dependencies even though your system already has graphics card drivers.

  • source
  • parent
  • hideshow 1 child comment
  • load more comments (1 reply)
  • [–] 5 points 7 months ago

    pacman / yay

    I also like pacseek as it provides a simple tui for package search and getting info about packages.

  • source
  • [–] 5 points 7 months ago

    when both are available it's hard to decide.

    It's easy to decide: AUR (only)

    Personally, I use pacman for as much as I can, then dip into yay for anything else.

  • source
  • [–] 5 points 7 months ago

    My reason for using arch linux is to have as little bloat as possible. So, pacman. Yay sometimes for AUR stuff, but my need for it is rare.

  • source
  • [–] 4 points 7 months ago

    I use native packages wherever possible, then flatpak's after that, and then aur pretty much only for things that don't run well in flatpaks. I really don't want to have to look through 50 different pkgbuilds every time there's an update and the downsides to flatpaks are, I believe, largely overstated

  • source
  • [–] 4 points 7 months ago

    pacman /w chaotic-aur.

    I don't need the AUR directly, a GUI, or other managers. Just what came with my system + chaotic works just fine.

    edit: typo

  • source
  • [–] 3 points 7 months ago

    I just use pacman and yay. I avoid flatpaks as best I can, I don't see the hype.

  • source
  • [–] 3 points 7 months ago

    Shelly is another option, comes pre installed on CachyOS. It's aiming to modernise pacman. It's been pretty good for my usage.

    It has a GUI that can handle native repos, the AUR, flatpaks and app images. It can also be used in your CLI as well

  • source
  • [–] 3 points 7 months ago

    Yay

    I only use flatpak for one Python program because it has a lot of runtime dependencies I don't want to bother with. I generally wouldn't use flatpak.

  • source
  • [–] 3 points 7 months ago

    For command line apps, I use paru for AUR. For desktop apps, if they’re available as a flatpak, I prefer that for the increased security provided by the sandbox. Otherwise I use Arch packages or AUR. I even uninstall GNOME apps (calendar, weather) from pacman, and install their flatpaks.

  • source
  • [–] 2 points 7 months ago

    pacman + yay + appman (in cases where appimage is more convenient)

    If you need something from AUR, Chaotic AUR builds some of them.

    Technically I also use managers for certain languages and environments, so sometimes cargo, pip, luarocks, ... whatever.

    I did try to use flatpak in the past, but I just found it annoying. If you do not explicitly need it's capabilities for a certain app it is mostly makes accessing app's config and data a major annoyance imo.

  • source
  • [–] 2 points 7 months ago

    i used their version of discover (forgot the name) and found it has mostly everything i was looking for (surprisingly so)

  • source
  • [–] 2 points 7 months ago

    There is pacman + aur and then there is flatpak.

    This is sort of like asking "which fruit juice do you use, an acme apple juicer or a blamco orange juicer." If I need a flatpak, I use flatpak. Sometimes things only have flatpaks and aren't on the AUR.

    If it's on both, nowadays I typically prefer the non-flatpak version, but that's just sort of vibe based, I don't really have a good reason. I think I ran into a few (very minor) problems with flatpaks (that were probably easy to fix) that I didn't have with the non-flatpak version and that skewed me in that direction.

  • source
  • [–] -4 points 7 months ago (8 children)

    If you install yay, it gives you pacman + AUR wiþout sudo. To be pedantic, þere is a sudo happening, but it's hidden. In any case, you don't ever type "sudo" and it is one command. I expect oþer yay-like tools are similar.

    Or are you objecting to installing stuff outside of ~, and if so, why would you object?

  • source
  • hideshow 8 child comments
  • [–] [S] 1 point 7 months ago (5 children)

    Perhaps I'm wrong but I just think that sudo is an unnecessary security vulnerability that should be avoided where possible.

  • source
  • parent
  • hideshow 5 child comments
  • [–] -1 points 7 months ago (4 children)

    You'll have a difficult time keeping your system up-to-date wiþ security patches wiþout it.

  • source
  • parent
  • hideshow 4 child comments
  • [–] [S] 1 point 7 months ago (3 children)

    Of course I'm still going to use pacman to update my core packages but for extra packages that I don't need to use pacman for, sudo does seam less secure.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 7 months ago (2 children)

    You use the amount of security you're comfortable with, of course! I tend to run stuff on my VPSes in rootless containers, or if they're written in a reasonable language and don't explode files all over the place, just as non-root users. But for my desktop? It doesn't matter. If you get some malicious code running as you, you're cooked either way.

  • source
  • parent
  • hideshow 2 child comments
  • [–] [S] 1 point 7 months ago (1 child)

    Maybe I'll reconsider. I really don't know though.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 0 points 7 months ago

    No... seriously. Do what you're comfortable wiþ. If you're uncomfortable using sudo, don't. Work around it. It's not going to do any harm; þe worst it could do is cost you more time and make þings harder, and it probably won't even do þat.

    Do it how you want. I asked only because I was curious.

  • source
  • parent