https://invent.kde.org/kde-linux/kde-linux-packages/-/blob/master/make-packages.sh gets various things from AUR, creates a local AUR repo, and outputs a number of PKGBUILD files. This isn't ideal for multiple reasons: - **Security:** AUR has a substantially lower level of security than the packages in Arch's main repos. Malware has been discovered in AUR packages [multiple](https://linuxiac.com/malware-discovered-in-arch-linux-aur-packages/) [times](https://linuxiac.com/arch-aur-under-fire-once-more-as-malware-resurfaces/) recently. - **Reliability:** AUR has occasional downtime and this blocks the packages pipeline, which means people who depend on git master staying current end up with stale content. The last outage lasted multiple days, from 2025-08-12 through 2025-08-15. - **Simplicity:** Violates the "no packaging knowledge required to develop it" aspiration, because now you do need to understand something about Arch PKGBUILD files and how they're produced and consumed. - **Breaks distro-agnosticism:** In principle KDE Linux aspires to be agnostic about the base distro, so that swapping it out for another one is easy. With the packages pipeline producing a local AUR repo and PKGBUILD files, that isn't true anymore. I think we should migrate away from this before the public release. The packages pipeline should just spit out a tarball or something. Final work item to unblock this is https://invent.kde.org/kde-linux/kde-linux/-/work_items/550.