I want to start a discussion regarding how dependencies are handled on
archlinux source builds of ROS.
The main issue is that not all dependencies can be filled using official
arch-linux packages. However often in these cases AUR community
packages are available. In the past, some ros dependencies were filled
from the AUR repository using yaourt or packer.
The question at hand is whether to let ROS automatically install
packages from AUR or to fail until the sysop manually installs the
necessary dependencies.
AUR packages are not officially supported and Arch policy & philosophy
is that AUR packages should never be automatically installed. The
simplified reasoning is that AUR packages are security risks because
anyone can create them, and that the typical arch user can quickly write
a script for any automation they wish. In otherwords, Arch give you all
the parts for a working gun, but only those with enough knowledge to
assemble it can shoot themselves.
So it makes sense to me that automatically installing AUR packages
should NOT be done by ROS. Thoughts?
Traveler Hauptman
(text/plain)