AUR & Custom Packages
AUR packages are vendored as reviewed PKGBUILD snapshots and built locally, rather than pulled through a general-purpose AUR helper.
Two kinds of non-official packages exist in this repo:
packages/aur/: PKGBUILD snapshots of genuinely upstream AUR packages sobarch depends on.packages/custom/: sobarch's own packages, often packaging content that lives elsewhere in this same repo.
Both are built and installed the same way. There's no AUR helper installed or required anywhere on the system. An AUR helper can build arbitrary, unreviewed AUR packages on demand, which cuts against sobarch's minimalism and security goals: every PKGBUILD that does end up vendored here is reviewed and scanned before merge, not fetched and built blind at install time. The build script also refuses any name that isn't actually present in those two directories, so it can't be pointed at an arbitrary package.
Because Arch's official repositories evolve, packages vendored from the AUR are periodically re-checked and migrated out once they graduate to extra: vendoring is a means, not a commitment to stay on the AUR forever.
Vendored AUR packages
| Package | What it is | Pulled in by |
|---|---|---|
localsend-bin | Open-source, AirDrop-style file sharing | Every install |
blesh-git | ble.sh, the Bash line editor used by the shell setup | Every install |
gale-bin | Lightweight Thunderstore mod client | Gaming profile |
protonup-qt-bin | Installs Proton-GE for Steam and Wine-GE for Lutris | Gaming profile |
orca-slicer-bin | G-code slicer for 3D printers | Maker / 3D Printing profile |
sunshine-bin | Self-hosted game stream host for Moonlight, also used for remote desktop | Remote Access profile |
quickemu-git | Quickly create and run Windows, macOS and Linux VMs | Virtualization profile |
quickgui-bin | Flutter frontend for quickemu | Virtualization profile |
brave-origin-bin | Brave's minimalist browser build | Browsers & Chat profile |
vesktop-bin | Vesktop, a Discord client with Vencord built in | Browsers & Chat profile |
nvidia-580xx-utils, lib32-nvidia-580xx-utils | Legacy NVIDIA 580xx driver branch (one build also produces the matching DKMS and OpenCL packages) | Installer, only when a Maxwell, Pascal or Volta GPU is detected |
The "every install" packages (these two plus tinty-bin, listed below) are named in scripts/aur-sync/base-required-packages.txt, the one list both the installer and Update System read. They are built synchronously during the install itself, before first boot. Profile packages are installed after first boot, as described in Software Profiles.
Custom packages
| Package | What it ships |
|---|---|
sobarch-skel | The default desktop configuration (the dotfiles merged into $HOME by Updating Your Config), the profile list the Install menu reads, the system-wide default-application list (/etc/xdg/mimeapps.list, which your own choices override), and the branding assets used for the boot splash, boot menu and login screen. |
sobarch-scripts | The sobarch command, the update flow, the package sync script and its pacman hook, the first-boot scripts, the NetworkManager dispatcher script, the daily update-check timer, and the snapshot restore and rescue refresh helpers, and the scripts that re-apply the boot menu, login screen and boot splash theming. Scripts live in /usr/local/lib/sobarch/; the sobarch command is /usr/local/bin/sobarch. |
sobarch-limine-snapshots | The sobarch-limine-snapshotd service (and the sync script it runs), which keeps one Limine boot entry per Snapper snapshot, so any snapshot can be booted straight from the boot menu. See Snapshots. |
sobarch-via-udev | A udev rule granting hidraw access so keyboards can be configured from the VIA web app (usevia.app) without root. Opt-in through the System Tuning profile. |
tinty-bin | Base16/Base24 colour scheme manager behind theming; repackages upstream's prebuilt release binary, since the AUR only has the slow-to-compile tinty-git. Built on every install. |
vesktop-integrity-launch | A launch wrapper for Vesktop that checks the Vencord files against a local baseline and runs Vesktop's own repair when they don't match. |
How the Vesktop wrapper is installed
vesktop-integrity-launch is not a profile choice of its own. It's a companion of vesktop-bin: whenever vesktop-bin is installed by name (from the Install Apps menu, first boot, or sobarch aur-sync vesktop-bin), the wrapper is built and installed alongside it. A pacman hook then writes a menu entry in /usr/local/share/applications/ that overrides the stock one so launching Vesktop from the app launcher goes through the wrapper. The override is regenerated on every vesktop-bin change and removed again if either package goes away; the file vesktop-bin owns is never touched. Once installed, the wrapper is kept current by the normal sync like any other vendored package.
How vendored packages are vetted
A weekly CI job compares each vendored AUR package with its upstream AUR repository. For a normal package it compares versions. For a -git package, whose version is recomputed at build time and so says nothing about whether upstream moved, it compares the PKGBUILD content instead. When something differs, the job opens a pull request with the new snapshot, along with the output of two advisory checks: namcap (a PKGBUILD linter) and a static security scan of the package files. It also fails the run if a package's committed .SRCINFO doesn't match its PKGBUILD, because that file is what the sync script trusts for the version to install. Nothing merges without a human reading the diff. Two of the custom packages track an upstream too, so the same workflow also bumps tinty-bin to the latest upstream release and vesktop-integrity-launch to its upstream's current HEAD, each as its own pull request.
Sobarch's own custom packages are checked locally instead: a git pre-commit hook rebuilds each .SRCINFO and, if a package's payload changed without a version bump, bumps the version (today's date, or the next pkgrel if it was already bumped today) and stages the fix. Contributors enable it once per clone with scripts/install-git-hooks.sh. The tinty-bin and vesktop-integrity-launch bump pull requests run the same validator.
Other CI workflows
- ISO build: on the 5th of each month (and on demand) a workflow builds the prebuilt installer ISO, signs it with a detached GPG signature, and publishes both as a GitHub Release. See Prebuilt ISO.
- Website: every push to
masterthat toucheswebsite/rebuilds this site with Zola and deploys it to GitHub Pages. - AUR update check: runs weekly (Mondays) or on demand, as described above.