Lock AUR dependencies

[MadLittleMods]

Anyone can submit a package to the Arch User Repository (AUR) which means there is potential for malicious packages. Since Arch is a rolling release, when using pamac/pacman, everything updates to the latest version any time you install/remove something. It would be nice to lock some of those AUR dependencies down so they have less of a chance to change under my feet.

Find AUR packages

$ pacman --query --foreign

Find orphaned packages

https://wiki.manjaro.org/index.php/Pamac#Dealing_with_Orphaned_Packages

$ pamac list -o

Solution: Lock AUR dependencies

/etc/pacman.conf

# eric: Lock AUR packages so they don't update under our feet with something malicious
IgnorePkg    = bfg

Dev notes

• https://forum.manjaro.org/t/how-to-lock-in-a-packages-version/112562
• https://bbs.archlinux.org/viewtopic.php?id=15768
• https://www.makeuseof.com/prevent-packages-from-getting-updated-arch-linux/