AUR Package Dependencies

An AUR repository supplies a PKGBUILD: executable packaging metadata, not a binary package or a dependency resolver. Building a package safely therefore requires distinguishing the dependencies that make the build possible from the dependencies installed on the resulting system.

Dependency Classes in PKGBUILD #

PKGBUILD(5) defines dependency arrays with different lifetimes:

• depends declares packages required to run the installed package.
• makedepends declares tools and libraries required only while building.
• checkdepends declares packages needed by check().

Version constraints use pacman’s dependency syntax, for example depends=('libfoo>=2'). Split packages can have package-specific dependency arrays such as package_client() { depends=('libclient') }.

Do not move a runtime library into makedepends merely because the package builds without it. Conversely, do not retain a compiler in depends when no installed file requires it. Accurate arrays allow pacman to plan upgrades and removals correctly.

makepkg Builds; pacman Installs #

Run makepkg as an unprivileged user. It downloads and verifies sources, checks dependencies, executes prepare(), build(), check(), and package(), and creates an archive for pacman. makepkg -i installs that archive only after a successful build; pacman performs the installation.

git clone https://aur.archlinux.org/example.git
cd example
makepkg --cleanbuild --syncdeps
sudo pacman -U ./*.pkg.tar.zst

--syncdeps asks pacman to install missing dependencies. Thus it resolves only packages available in configured binary repositories. It cannot obtain an AUR dependency because the AUR distributes build recipes, not repository packages.

Avoid --nodeps and never run makepkg with sudo; bypassing dependency checks can produce an incorrectly linked package, while root executes unreviewed PKGBUILD shell code with unnecessary privileges.

Build an AUR Dependency Chain #

Resolve AUR dependencies in dependency order. Inspect every recipe before executing it, build the leaves first, and install their resulting archives so the next package’s dependency test succeeds.

# Build and install the AUR dependency first.
git clone https://aur.archlinux.org/example-library.git
cd example-library
makepkg --cleanbuild --syncdeps
sudo pacman -U ./*.pkg.tar.zst

# Then build the dependent package.
cd ../example
makepkg --cleanbuild --syncdeps

An AUR helper may automate graph traversal, but it does not replace review: each PKGBUILD, .SRCINFO, source URL, patch, and install script remains part of the trusted build input. Check version constraints across the complete chain before building.

Use a Clean Chroot for Reproducibility #

Host-installed packages can conceal missing declarations. A clean chroot starts from a defined Arch base and makes missing makedepends and checkdepends visible. With devtools configured, build from the package directory with:

extra-x86_64-build

Build prerequisite AUR packages into a local repository or install their verified archives into the chroot before building dependents. Recreate or update the chroot deliberately when testing a dependency chain, and retain build logs and package archives for investigation. A successful clean-chroot build demonstrates declared build inputs; it does not prove that the recipe or its upstream sources are safe.