[ros-users] Archlinux dependencies handling

[Traveler]

I want to start a discussion regarding how dependencies are handled on 
archlinux source builds of ROS.

The main issue is that not all dependencies can be filled using official 
arch-linux packages. However often in these cases  AUR community 
packages are available. In the past, some ros dependencies were filled 
from the AUR repository using yaourt or packer.

The question at hand is whether to let ROS automatically install 
packages from AUR or to fail until the sysop manually installs the 
necessary dependencies.

AUR packages are not officially supported and Arch policy & philosophy 
is that AUR packages should never be automatically installed. The 
simplified reasoning is that AUR packages are security risks because 
anyone can create them, and that the typical arch user can quickly write 
a script for any automation they wish. In otherwords, Arch give you all 
the parts for a working gun, but only those with enough knowledge to 
assemble it can shoot themselves.

So it makes sense to me that automatically installing AUR packages 
should NOT be done by ROS.  Thoughts?

Traveler Hauptman