How to exclude and include chaotic-aur when installing packages?

[ToneyFoxxy]

If it's not too much trouble, could you make it so using the Chaotic AUR optionally requires an additional flag? I really don't like the idea of mixing the AUR in with verified Arch packages. It opens up problems such as unstable packages or unwanted packages slipping through during a system upgrade, something that would normally only be a concern when using a dedicated AUR helper (Part of the reason there are no AUR helpers in the main repos). Now, if I could, for example, run sudo pacman -Syu -chaotic, that would eliminate these issues and enable selective usage of the Chaotic AUR.

To be clear, I'm not saying this should be the default, I'm saying it would make sense as a configurable option for users who find using the Chaotic AUR automatically quite concerning. I love the concept and really appreciate the work being done, however I can't install or enable it for the previously stated reasons and I believe there are many people in the same boat as I am

[Technetium1]

This is far outside the scope of Chaotic. We build and distribute packages. This would be a concern to bring to Pacman's developers instead. You would also be worried about partial upgrades.

for users who find using the Chaotic AUR automatically quite concerning

There are no users who use it automatically. No third party repos are added by default on Arch. If you mean derivative distributions that have trusted it by default, then it's a question to ask their creators. You can probably remove Chaotic and build the packages that orphan in your own local repo to solve your problem. I use this: https://github.com/alexheretic/aurto

[ToneyFoxxy]

I was thinking there should be a flag in Pacman to exclude specific repos, however it does not exist unfortunately. Partial upgrades should never be a concern, unless you guys are modifying the packages in the Chaotic AUR to have different dependencies, which you do not disclose and would be something approximating malicious behavior.

The second paragraph is completely false. When the repo is enabled, packages will be pulled from the Chaotic AUR via Pacman without further user input. That is automatic.

I understand why adding flags to Pacman would be difficult, however the rest of your response is misleading at best and feels more like you're just trying to make me feel bad for asking for some reason.

[dr460nf1r3]

If you think it is a concern I'd advise you to download updates manually using the mirrors without adding Chaotic-AUR to your mirror list. Installing these "automatically" by your definition is definitely intended behavior when using user repositories, isn't it?

[ToneyFoxxy]

It is intended behavior, I don't disagree with it functioning as such. I just wish it were optional beyond creating a macro to edit Pacman.conf

[Technetium1]

however the rest of your response is misleading at best and feels more like you're just trying to make me feel bad for asking for some reason.

@ToneyFoxxy:
I'm not trying to make you feel bad or mislead you, I just want you to be able to direct your pacman issue to the right place. I'm also trying to provide you the solution I use for building my own packages outside Chaotic if you don't wish to use it. We don't build everything, and that's intentional. For example, I use aurto to build python2 and the last couple of things that I use that depend on it.

unless you guys are modifying the packages in the Chaotic AUR to have different dependencies, which you do not disclose and would be something approximating malicious behavior

As mentioned and acknowledged above, this is by design and expected. We do sometimes fix [modify] packages that don't build in a clean chroot, or have been abandoned but still need to be used. ALL of that is public and viewable here: https://github.com/chaotic-aur/interfere. You are highly encouraged to look.

Partial upgrades should never be a concern

Until you use a package in the AUR that doesn't bump, and depends on something in another repo that has bumped, and you no longer have the right shared lib version available. This is one of the reasons utilities like https://github.com/openSUSE/snapper can save the day. We also have an ability to force rebuilds through 'bumps' on our side, as documented here: https://github.com/chaotic-aur/notes#our-interfere-repo

[ToneyFoxxy]

An alternative idea would be to somehow append -chaotic to all package names in the repo, then have the user determine whether writing -chaotic is necessary for retrieving the Chaotic version of the package. For that to work, you would also need to make Pacman doesn't read it with -chaotic at the end

[xiota]

What you want to do is sort of already built into pacman, but not exactly the way you describe. From man pacman.conf:

REPOSITORY SECTIONS

       Usage = ...
           Set the usage level for this repository. This option takes a list of tokens which must be at least
           one of the following:

           Sync
               Enables refreshes for this repository.

           Search
               Enables searching for this repository.

           Install
               Enables installation of packages from this repository during a --sync operation.

           Upgrade
               Allows this repository to be a valid source of packages when performing a --sysupgrade.

           All
               Enables all of the above features for the repository. This is the default if not specified.

               Note that an enabled repository can be operated on explicitly, regardless of the Usage level set.

So when you install chaotic-aur in pacman.conf you want to enable Sync and Search. Then, unless you specify the source repository, pacman will install and upgrade only from the standard Arch repositories.

# pacman.conf

[chaotic-aur]
Include = /etc/pacman.d/chaotic-mirrorlist
Usage = Sync Search

# install from extra
sudo pacman -S yt-dlp

# install from chaotic-aur
sudo pacman -S chaotic-aur/catt

# refuse to install
sudo pacman -S catt