SakuraOS Wiki
All pages ↓

The AUR

The Arch User Repository (AUR) has build scripts for thousands of programs that are not in Arch's own repositories. Anyone can publish one and nobody reviews them, so SakuraOS keeps the AUR off until you turn it on, and shows you each build script before it runs.

Turning it on

  1. Open System Settings → SakuraOS.

  2. Tick Allow installing packages from the AUR and press Apply.

The App Store now includes AUR packages in its results.

Installing from the App Store

  1. Find the application and open its page. Under Install from, choose AUR. The store only selects the AUR itself when there is no other source.

  2. Press Install. Before anything is built, the store shows the package's build script and some facts about it, for example:

    • how many people have voted for it, and whether it is flagged out of date or has no maintainer;
    • whether its maintainer changed recently, or it was adopted recently;
    • whether it downloads from somewhere other than the project's own website;
    • if you installed it before, exactly what changed in the script since then.

  3. Read it. If it looks right, accept it. The package is built, a restore point is taken, and it is installed.

A build script is a program that runs on your computer, so reading it is the real protection. If a script downloads something from an unexpected place, or does more than building the program, do not accept it.

Some packages need others that are also only in the AUR. The App Store finds every one of them before anything is built, and the review shows each build script with what needs it, so you can read them all in one place. Accepting builds them in order, the ones that are needed first, and asks for your password once if the builds are quick; a long build asks again before the last install. Removing the application later removes them too, unless something else needs them.

Packages that build a kernel module with DKMS, such as evdi-dkms for DisplayLink docks, also need the headers for your kernel. The App Store installs those as well.

If something a package needs is in neither Arch's repositories nor the AUR, the App Store says which one and does not start. That usually means the package needs updating by its maintainer, for example one that still asks for an old version of Electron.

Using yay or paru

To use the AUR from a terminal, choose yay or paru under Command-line helper in SakuraOS settings. Then, for example: 

yay -S package-name     # install a package
yay -Sua                # update your AUR packages

paru takes the same commands. The helpers show you the build script in their own way, instead of the App Store's review screen. Do not run them with sudo; they ask for your password when they need it.

The malware check

When malware is found in the AUR, the affected packages, and the files and services they install, are published. SakuraOS compares your computer with those lists after every install and once a day, whichever way you installed, and reports any match.

It only knows about attacks that have already been found and published. It cannot tell whether a new package is safe, which is why the build script is shown to you. You can turn the check off in SakuraOS settings, but we recommend leaving it on.

Updating AUR packages

AUR packages are never updated automatically, because each update runs a new version of someone's build script. The App Store lists AUR packages that have a newer version on its Installed page. To update them, use your helper: 

yay -Sua

Removing an AUR package

In the App Store, open Installed, choose it, and press Uninstall. From a terminal: sudo pacman -R package-name.

Last checked against the SakuraOS release of 3 October 2026. If your system behaves differently from this page, the page is wrong: please report it.