A secure build tool for Arch Linux AUR packages with isolated builds, review workflows, and detailed package inspection.
RUA is a build tool for Arch Linux's AUR (Arch User Repository) that provides secure, isolated package building with comprehensive review capabilities. It solves the security concerns of traditional AUR helpers by running builds in a namespace jail and allowing users to inspect packages before installation.
Arch Linux users who install packages from the AUR and want enhanced security, control over the build process, and detailed package inspection capabilities.
Developers choose RUA for its strong security isolation using bubblewrap and seccomp, its thorough review workflow for AUR packages, and its ability to provide detailed package information without sacrificing usability.
Build tool for Arch Linux providing control, review and jailed build options
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses bubblewrap and seccomp to run builds in a namespace jail with restricted filesystem and syscall access, preventing malicious code from affecting the host system.
Allows reviewing upstream changes, applying local patches, and batch reviewing built packages before installation, giving users full control over updates.
Warns about SUID files in built packages and runs shellcheck on PKGBUILDs to detect potential issues, enhancing package safety and code quality.
Supports building packages without network access using the --offline flag, useful for secure or disconnected environments.
Groups AUR dependencies by depth to minimize interruptions during recursive builds, improving user experience compared to plain recursive helpers.
Focuses solely on AUR packages and does not integrate with pacman for system updates (e.g., no -Suy support), requiring users to juggle multiple tools.
Safety restrictions block X11 access and ccache usage during builds, which can break certain packages or force dependency re-downloads, slowing down builds.
Does not handle optional dependencies (optdepends) or version management—always installs the latest version and skips optdepends, necessitating manual checks.
Requires manual whitelisting of directories via wrap_args for shared caches and has specific setup needs like bubblewrap-suid, adding friction for advanced use cases.