AUR helpers: paru and yay

arch / published / guide #11 / ≈ 2 min read

The Arch User Repository (AUR) is a giant collection of recipes — not the packages themselves, but instructions for building them. Anyone can contribute, so it's where you find software the official repos don't carry. To use it you need an AUR helper that automates the download → build → install dance.

Two helpers are popular: yay and paru. They do the same thing in slightly different ways. Pick one — don't install both.

Bootstrap yay (no AUR helper yet)

You can't install yay from the AUR without an AUR helper, so the first install is manual. Make sure you have the build tools:

sudo pacman -S --needed base-devel git

Then clone the recipe and build it:

git clone https://aur.archlinux.org/yay.git
cd yay
makepkg -si

makepkg -si means "build it, pulling in any needed build dependencies (s), then install the result (i)." It'll ask for your sudo password partway through.

Daily commands

yay -S bat               # search + install (works for repo packages too)
yay -Syu                 # upgrade everything, including AUR
yay -Sua                 # upgrade only AUR packages
yay -Rns whatever        # remove
yay -Yc                  # clean up unneeded build dependencies
yay -Ps                  # print quick system stats (fun)

Most of yay's flags are the same as pacman's, plus a few extras (-a for "AUR only").

The safety conversation

The AUR is community-maintained. There's no formal review. When you install something, you're trusting whoever uploaded the PKGBUILD (the recipe). Most of the time this is fine — but it's worth checking.

Read the recipe before installing:

yay -S --editmenu some-aur-pkg

That drops you into an editor on the PKGBUILD and any related files. Look for: where is it downloading from? Does it run a script as root? Has the maintainer been active recently?

Signals to slow down:

  • Very few votes on the AUR website.
  • Maintainer changed recently.
  • Last update was years ago.
  • The URL points to a personal server you've never heard of.

paru — same idea, written in Rust

If you'd rather try paru, it's a near drop-in replacement. After installing yay, just yay -S paru-bin and remove yay if you prefer paru's defaults. They're both great; the choice is stylistic.

Common gotcha: build dependencies

Building an AUR package can pull in dozens of build-only dependencies. After the build, they're no longer needed but stick around as orphans. Clean them up:

yay -Yc

This is roughly equivalent to sudo pacman -Rns $(pacman -Qdtq) but scoped to "things AUR builds dragged in."

← back to index