Chaotic-AUR

Scheduled maintainance - 2026-08-30 14:00 CEST - our Postgres database is getting an update 🔧

I'm happy to announce big updates to our website! Besides having received major updates in how things look, they are also a lot more interactive and useful than before 😀

- Build status now shows estimations for how long a build is going to take or when a build is assumed to start based on average build times.
- Build logs can be viewed live right in the website itself, searched, downloaded and shared. The same goes for pipeline logs!
- The entire history (which is ~2 years since we started using a database for these purposes) of deployment logs, as well as statistics and packages can be queried in many more ways than before.
- Update reviews became better than ever before due to better highlighting and some automated scans raising awareness for general things to be looked out for. I'm planning to expand this even further in the future.
- Most of the maintenance tasks can generally now be done from within the website, via GitLab SSO, which is also a great help. No more fiddling around with GitLabs web interface while on the run!

Besides our schedule pipeline, which does most of the heavy in regard of updating our PKGBUILDs from various sources, and opening MRs for us to review received some parallelization which allows it to finish in <5 minutes instead of 20-30 🚀

As a friendly reminder, please consider regularly auditing packages installed from AUR. The recent events show that being cautious is always a good idea. See also Pacman/Tips_and_tricks on ArchWiki. Here are some useful commands:

pacman -Qqm # list non-repo packages
pacman -Qqe # list explicitly installed packages
pacman -Qdt # list orphaned depends

Package updates will be paused for a while as pushing to AUR is currently disabled.

Stay safe, everyone!

Just as a heads-up, we are aware of the wave of current injections of malicious content in AUR packages.

Our security measures are working perfectly so far and have already prevented a few of them from getting deployed.

Please be extra careful when updating packages directly from AUR in the coming days! Especially watch out for the addition of an npm or bun dependency and an additional .install script in PKGBUILDs.

Some of you may have noticed, there are now many "official" mirrors available: https://aur.chaotic.cx/mirrors

These 52 new mirrors are operated by the chaotic-aur operations team on donated servers, more than doubling chaotic-aur's previous mirror count.

Getting all of these servers online has been a massive undertaking, but now we have better mirror coverage than ever before: https://status.chaotic.cx/map

These have been added to the mirrorlist as well as geo-mirror. Enjoy!

A new mirror system is now active:

All country mirrors (for example, in-mirror) will redirect:
1. All users in the country to the closest mirror in that country
2. All users in other countries to a random (persistent) mirror in that country (To prevent the mirrors on country borders getting overwhelmed)
If all mirrors in a country are unavailable, router will return an applicable error code

Geo-mirror will keep working like normal.

All *specific* mirrors (for example br-1-mirror) will now no longer silently fail over to another mirror if offline (but will instead provide a generic applicable http error code)

random-mirror will now redirect to a random (but persistent) mirror for each IP address.

A new mirror list containing the changes has been deployed.

In case anyone wants to have an overview of what is queued for review (e.g. in case an expected package update appears to be late), we have a dedicated page by now (which also simplifies any action maintainers need to take in order to review efficiently) 🕵🏻‍♂️

What's up, everyone? 👋🏻

Some good news for Chaotic-AUR users: after the rising count of cases of malware in AUR, we now have a system of a trusted maintainer's list in place. This list is being checked before updating packages silently like before. There are multiple outcomes:

1. All maintainers are trusted -> silently update package like before
2. At least one maintainer is untrusted (sadly, the AUR API does not seem to expose the last packager, which is, however, being shown in the web interface for some reason):
a) Only pkgver/hash changes -> silently update
b) Anything else changes -> open PR for human review
3. State updates are also always allowed (e.g. commit hashes of git packages)

While we can't yet tell how sustainable reviewing the untrusted portion of package updates will be, it is certainly a good step to take moving forward. Maybe this also opens the door for people to contribute, e.g., by reviewing the package updates created via PR 😇 (if anyone is interested: let the team know!)

Besides that, the website will also live-update on any deployment, queue and pipeline change for a more interactive experience 🙌🏻

🎂🎈

While it hasn't been half a year since the last rework of our website, another one just reached production 😌

This time the focus was pretty much on improving the way we retrieve information, as well as enhancing the amount of information shown to end users and maintainers while improving the look and feel to be more modern than before.

Some highlights include:
- A new mirror page showing the router's data (the same as the map uses)
- Enhanced statistics pages, using ChartJS for visualization (these seem to be glitchy at times, but this apparently happens in official examples as well)
- Much more overall data is available for packages, deployment logs and other places
- All dependencies on the Telegram API in the backend has been dropped. The news feeds is served as static file instead, and deploy logs come from our database
- Speed should be improved as well, thanks to better ways of obtaining data and lazy loading
- The news feed received real, and proper formatting
- Build status now shows ongoing pipelines, and allows retrieving status updates for build processes (e.g., "waiting for builder")
- Data is displayed using fully searchable tables
- And of course, theming was tremendously improved! 🎨

Things left to do include moving the backend to a speedier location (if stuff loads slowly, this is the reason) and maybe adding more charts for statistics 🧑‍💻

Merry Christmas to everyone out there! 🎄🤗 may all of you have a wonderful vacation.

I'm happy to announce that we are now able to handle up to 30x more requests/sec via our router than before 📈
After the recent outage steps have been taken to optimize it, effectively ending up in a Typescript rewrite.
Special thanks going to TNE, who implemented the changes! 🚀

Under attack disabled, traffic should be normal (except if you were part of the abnormal requests)

Sorry guys, we needed to set our router into "Under attack" mode after 500k requests come knocking at our door.

Who could it be now? 🎷

And of course, a heartfelt thank you goes out to the rest of the team and our community.
The submissions for our new memorial have closed and the result is available here. Thanks to everyone who contributed to it ☺️

We hope you guys enjoy the new stuff announced today. On to many more years! 🍻❤️

Today is a special day because it marks the 6th birthday of this project, as well as the day when the next big evolution of our build tools finally goes live.

While we already highlighted the most prominent changes between those three years in our previous post, it is a pleasure to be officially announcing our new build system, also called infra 4.0 ☺️ This is the end of a journey that took more than half a year to finally be filling close to all Chaotic-AUR build requirements. While this is primarily a solution written for Chaotic-AUR, it is still a generic solution everyone wanting to compile PKGBUILDs on smaller or larger scale can adopt.

Why would we need a new build system if the old one was working well? The question is easy: the pre-assumptions the previous infra had, like inhomogeneous builder landscapes lead to some drawbacks (while serving a really good job for many years nevertheless!). One of them is that we continually need to run routines to check packages for new updates, another one being unable to control the allocation of builds to individual builders.
This time, we were able to work with different pre-assumptions, which allowed us to optimize the entire process to a great extent. The fact that we've been running the entire load of Chaotic-AUR in our infra 4.0 test environment on our main builder besides the regular builds is a great example of how efficient it has become.

Since the entire process consists of GitLab CI pipelines and a central instance for managing build processes after they have been scheduled by the pipelines, it is also much easier for users to figure out when packages were updated, as well as being able to inspect logs for multiple revisions of builds. This also means that our well-known packages repository is now mainly operated on GitLab CI due to making use of their CI tools. To preserve issues and comment histories, the "old" repository will be kept as a read-only mirror of the main repository, and also kept open for issues and bug reports.

There are many other changes and new features, like:
- Builds getting scheduled on demand (read: whenever an AUR package changes and CI pipelines pull in the updated files, or someone pushes a change to a locally maintained package) rather than with every routine run
- Live logs can be opened either via the pipeline's external stages, as well as being presented on our status page of the website. If you always wanted to watch your Ungoogled Chromium build logs in real-time - now it is possible 😎
- Build queues are visible to the public, also on the status page
- Support of build for multiple repos at once
- Saving/Restoring build queue state on builder/manager shutdown
- Dependency trees
- Automated lib bumps (which are not enabled for most packages, as adding deps is a manual process. The plan is to enable this for more packages in the following months)
- No more split repos for packages and interference - the repo now consists of folders, one for each pkgbase. Inside it, you may find a .CI folder with interferes and further builds configurations
- Being able to maintain a PKGBUILD on Chaotic-AURs repo, and pushing it back to AUR automatically, whenever a new change gets pushed. This opens a door for AUR packages to be community-maintained via PRs (looking at you, proton-ge-custom!)
- The state present in the packages repo fully reflects the state of the repository. Packages not present will automatically be removed
- Being able to review non-trivial package updates (which is opt-in and turned off for Chaotic-AUR. Might explore the idea of a reviewed/trusted subset of packages in the future)

For everyone wanting to take a closer look inside, dedicated documentation is available here.

At this point, I want to especially thank two people, who played a major role in making this possible.
- TNE, whose ideas and visions ensured all of it became as efficient as it turned out.
- xiota , who did close to all of the heavy lifting regarding porting our current set of packages to v4 and provided feedback on build processes and existing issues

Three days are left for memorial submissions! ☺️

Chaotic-AUR turns six years old on October 18! 🥳

It has been three years since celebrating Chaotic-AUR's birthday with a memorial.
We would love to repeat this occasion this year, as it's the exactly double the years as the last time! ☺️

Let's see what happened in the meantime 🕵

- Our user count is currently around 107k per month;
- The amount of offered packages is roughly 3400 (after a big cleanup happening)
- Active mirror count decreased to 12, but the CDN-mirror is powered by blazing-fast Cloudflare R2 these days
- The website got a complete rewrite and now offers a lot of useful functionality, such as viewing package lists and stats, build processes, and more information
- Though not directly Chaotic-AUR-related, the Chaotic-CX spaces gained a new project via Chaotic Nyx
- And there is something else really cool coming up at the day the birthday takes place (you might guess what it is - it's been hinted at in several places 😋) ! Stay tuned! 😇

This time, we will also be collecting screenshots of terminals and desktops showing fastfetch with the Chaotic-AUR logo. To take part in this special day, the following is needed:

- fastfetch (get it via Arch repos)
- The Chaotic-AUR logo
- Run fastfetch like that: fastfetch --logo ~/Downloads/logo.png --logo-width 45, replacing the location with the location the logo has been downloaded to, and width with something that makes the image fit the height of your fastfetch output
- Take a screenshot and either add a PR to the memorial repo, send it to memorial@chaotic.cx, @dr460nf1r3 or the group chat

Submissions will close on October 18, the day the birthday takes place.

A big thanks to everyone helping us with achieving the things we did during the last years. It certainly wouldn't be the same without you! ❤️

Hello, everyone 🤗

We have some interesting news to share - Chaotic-AUR's new website just went live 🎉
What started as a project to learn and improve Angular and Typescript skills quickly evolved into a useful tool for all Chaotic-AUR users and maintainers 😄 Not only is our memorial finally in place, but we can also show basic stats about packages and deployments. While we have a dedicated channel for news and deployments, these channels haven't been easily available to non-Telegram users. This changes today 😊 An important note about the deploy logs: these show the deployments of our currently in-development infra 4.0 as a preparation for its launch - the pilot phase is currently in progress. The features of the website will eventually be expanded in the future, as soon as we have more monitoring set up for our new build system 🧐

PS: If you find any issues with the website don't hesitate to report them to @dr460nf1r3 👾