AUR-BUILD(1)

NAME
aur-build - build packages to a local repository

SYNOPSIS
aur build [-d database] [-cfSU] [-a queue] [--no-sync] [--pkgver] [--root DIRECTORY] [--margs] [--cargs] [makepkg_args...]

DESCRIPTION
Build packages adding the results to a local repository. A local repository is a pacman(8) repository configured with a file:// prefix in pacman.conf(5).

OPTIONS

-a FILE, --arg-file=FILE
    A text file describing directories containing a PKGBUILD relative to the current directory. If unspecified, the current directory is assumed.

-c, --chroot
    Build packages inside a systemd-nspawn(1) container with aur-chroot. Specifying aur-chroot(1) options such as --bind or --temp will append these options to aur-chroot.

-d NAME, --database=NAME
    The name of the pacman(8) database.

--root=DIR
    The root directory for the repository. The root is the location for the pacman database (foo.db), built packages, and secondary files such as the files database (foo.files). This defaults to the value of the Server directive for the configured repository.

    Note: The Server directive configured in pacman.conf(5) is used for pacman(8) sync operations regardless of this setting. See also --no-sync.

-f, --force
    Continue the build process if a package with the same name is found. Without this option, aur-build will add existing packages to the local repository and (if --sign is specified) gpg(1) sign them.

    Note: Packages are checked for existence prior to calling makepkg or aur-chroot with makepkg --packagelist. If a package script has a pkgver() function, package names may be outdated. The check can then be bypassed with --force, or the pkgver() function run priorly with --pkgver.

-S, --sign, --gpg-sign
    Sign built packages and the database (repo-add -s) with gpg(1). To use another key than the default, the GPGKEY environment variable can be set to the appropriate key identifier.

    Should the signing process fail for any reason, corresponding packages are not moved to the local repository. aur-build will instead exit with a diagnostic containing the package paths.

--pkgver
    Run makepkg -od before checking existing packages, effectively running the pkgver() function if present. The --noextract option is added to the default makepkg(8) options.

    The --rmdeps, --syncdeps, and --noconfirm options are forwarded to the above command. Other makepkg(8) options are ignored.

--makepkg-conf=FILE
    The makepkg.conf(5) file used for makepkg(8) operations. For chroot builds, the file is also used inside the container. (makepkg --config, aur-chroot --makepkg-conf).

--makepkg-gnupghome=PATH
    The gpg(1) home directory used with makepkg(8) or aur-chroot(1).

--pacman-conf=FILE
    The file used for retrieving local repositories (aur-repo --config). For chroot builds, the file is also used for pacman(8) operations inside the container (aur-chroot --pacman-conf).

    pacman(5) calls made by makepkg(8) and local repository upgrades (see the Repository updates section) are unaffected by this option.

--cargs=ARGS, --makechrootpkg-args=ARGS
    Arguments (comma-separated) to be passed to makechrootpkg for chroot builds (aur-chroot --cargs).

--no-sync
    Do not sync the local repository after building.

--results=FILE
    Write colon-delimited output in the following form to FILE:

    <action>:file://<path>

    where <action> is either build or exist, for built packages and packages already available in the local repository, respectively.

  makepkg options
Additional options may be passed to makepkg by placing them after --margs (comma-separated). --margs, --ignorearch, and --nocheck are forwarded to aur-chroot when the --chroot option is specified.

--nocheck
    Do not run the check() function in the PKGBUILD. (makepkg --nocheck)

-n, --noconfirm, --no-confirm
    Do not wait for user input. (makepkg --noconfirm)

-r, --rmdeps
    Remove dependencies installed by makepkg. (makepkg --rmdeps)

-s, --syncdeps
    Install missing dependencies using pacman. (makepkg --syncdeps)

-A, --ignorearch
    Ignore a missing or incomplete arch field in the build script. (makepkg --ignorearch)

-L, --log
    Enable logging to a text file in the build directory. (makepkg --log)

-C, --clean
    Clean up leftover work files and directories after a successful build. (makepkg --clean)

--cleanbuild
    Remove the source directory before building the package. (makepkg --cleanbuild)

--buildscript=NAME
    Read the package script NAME instead of the PKGBUILD default. (makepkg -p)

  repo-add options

-v, --verify
    Verify the PGP signature of the database before updating. (repo-add -v)

-R, --remove
    Remove old package files from disk when updating their entry in the database. (repo-add -R)

--new
    Only add packages that are not already in the database. (repo-add -n)

--prevent-downgrade
    Do not add packages to the database if a newer version is already present. (repo-add -p)

ENVIRONMENT

AUR_REPO
    The repository used for building packages. If unspecified, the name is selected with aur-repo(1).

AUR_DBROOT
    The root directory of the repository. If unspecified, the path is retrieved with aur-repo(1).

AUR_DBEXT
    The extension name of the repository. Defaults to .db.

AUR_MAKEPKG
    The command used to build packages. Any makepkg(8) options (see the makepkg options section) forwarded must be supported by this command, as well as the -o, -d, and --noextract options if aur-build --pkgver is used.

AUR_MAKEPKG_GNUPGHOME
    Directory where the gpg(1) keyring for usage with makepkg(8) or aur-chroot(1) is stored. This variable takes precedence over GNUPGHOME. AUR_BUILD_PKGLIST The command used to check for built packages in the local repository. Defaults to aur build--pkglist. Compared to makepkg --packagelist, the default command runs faster by not linting the PKGBUILD.

AUR_GPG
    The command used to sign packages. The arguments --batch, --detach-sign, and --no-armor must be supported by this command.

AUR_REPO_ADD
    The command used to update the local repository. Any repo-add(8) options (see the repo-add options section) forwarded must be supported by this command.

AUR_PACMAN_AUTH
    A command prefix for running pacman(8) as root. If unset, sudo(8) is used. See also PACMAN_AUTH in makepkg.conf(5).

GNUPGHOME
    Directory where the gpg keyring for signing built packages and the database file is stored.

GPGKEY
    The GPG key used for signing packages. This environment variable is respected by aur-build and repo-add. When the variable is set in makepkg.conf(5), is it only respected by makepkg.

TMPDIR
    The directory for temporary files. (This includes intermediary storage of built packages, defaulting to /var/tmp.)

NOTES

  Repository updates
When building on the host (outside of a container), installed packages in the local repository are upgraded to the latest available version by running pacsync <repository> followed by pacman -S --noconfirm <repository>/<upgrades...>. This is comparable to makepkg -i, except that only priorly installed packages are upgraded to a new version.

  Using a dedicated build user
While using a dedicated user for the build process does not increase security (beyond protecting against packaging errors that write to $HOME), it may be useful when the local repository will be accessible to multiple users, or as a way to avoid password prompts. Note that such a user must be unprivileged; as of pacman 4.2, makepkg(8) may not run directly as root.

New users may be created with useradd(8) as follows:

        # useradd build --system --home-dir /var/cache/aurbuild --create-home

Because dependency resolution is not replicated and left to makepkg(8) (see handle_deps() in /usr/bin/makepkg) the aurbuild user should be allowed to run pacman(8) with elevated privileges.

For example, create the /etc/sudoers.d/10_build file with the following contents:

        aurbuild ALL = (root) NOPASSWD: /usr/bin/pacman, /usr/bin/pacsync

The following aur-build options require root access: --syncdeps, --rmdeps, --chroot. Root access are also required for pacsync(1) and pacman -S, unless the --nosync or --chroot options are specified.

aur-build(1) and related programs such as aur-sync(1) can now run as the new aurbuild user. For example:

        $ sudo -u aurbuild -i
        $ git clone https://aur.archlinux.org/mypackage.git
        $ cd mypackage
        $ aur build -d custom

Any created files in the local repository (such as packages, signatures and database files) will be owned by the aurbuild user and group.

To exchange files between the build user and a regular user, setfacl(1) may be used. For example, assume the directory /home/custompkgs is owned by $USER:USER, and that read/write access should be given to the aurbuild user. The following commands set the default permissions for this directory and modifies any existing permissions, respectively:

        $ setfacl -dm 'g:aurbuild:rwX' -Rm g:aurbuild:rwX -- /home/custompkgs

See also Avoiding password prompts in aur-chroot(1).

  PKGBUILD signatures
GPG signatures defined in the validpgpkeys array may be automatically retrieved by setting the auto-key-retrieve option in gpg.conf. Note that this option only works with signatures that include an issuer fingerprint. See --auto-key-retrieve in gpg(1) for details.

  Signing packages unattended
By default, gpg(1) will cache passphrases for a duration set by the default-cache-ttl option. If extending this duration is not desired, the passphrase can be cached manually with gpg-preset-passphrase before running aur-build(1).

The duration of the cached passphrase is set by the max-cache-ttl option, which defaults to 2 hours. See gpg-preset-passphrase(1) for details.

  Rebuilding packages against updated dependencies
It is sometimes required to rebuild packages when their dependencies are updated, for example in the case of dynamic library linking. To detect which packages require a rebuild, the rebuild-detector (https://github.com/maximbaz/rebuild-detector) package can be used.

To propagate rebuilt packages to clients, pkgver should be increased beforehand, e.g. with setconf(1).

  Installing dependencies with makepkg
If --syncdeps is specified, package dependencies are installed with makepkg -s. makepkg uses the pacman -S --asdeps command for this purpose. Other pacman options can be specified with a wrapper script and the PACMAN environment variable. See ENVIRONMENT VARIABLES in makepkg(8) for details.

  Thread safety
aur-build builds and signs packages inside a private directory located in /var/tmp. On success, packages and their signatures are moved with mv(1), which is atomic if the local repository is on the same file system as /var/tmp. makepkg(8) may still write to the PKGBUILD in a shared directory, for example when a pkgver() function is available. Because of this, it is advised to split the argument file (-a FILE) into independent arguments, or increase the number of jobs with MAKEFLAGS per makepkg.conf(5).

BUGS
Databases are built with LANG=C to avoid libalpm from skipping entries if the locale is not set (FS#49342).

Packages are signed manually with gpg --batch --detach-sign --no-armor since chroot builds have no access to pinenentry variables, and to allow signing existing packages without signature.

pacman(8) has a size-limit of 25 MiB for databases. The use of larger databases may result in an expected download size exceeded error. To avoid this issue, compress the database with gzip(1). See https://git.archlinux.org/pacman.git/commit/?id=6dc71926f9b16ebcf11b924941092d6eab204224 for details.

While pacman(8) options can be passed to makepkg -s (aur-build --syncdeps) by setting the PACMAN environment variable, the value of pacman --dbpath is fixed.

SEE ALSO
aur(1), aur-chroot(1), aur-repo(1), makepkg.conf(5), pacman.conf(5), sudoers(5), makepkg(8), pacman(8), repo-add(8), sudo(8)

AUTHORS
Alad Wenter (https://github.com/AladW)