Hello, after an update using pacman I got the following message from yay (yay -Syu):
:: Searching AUR for updates…
→ pygtk : local package (2.24.0-16) is newer than the package available on AUR (2.24.0-12)
→ Missing AUR packages : galculator-gtk2 gksu-polkit js52 js60 js68 kvantum-theme-matchama libnm-glib mhwd-catalyst mhwd-nvidia-340xx python-sip-pyqt5 xf86-input-keyboard xf86-input-mouse xorg-fonts-alias
→ Orphaned AUR packages : libgee06
:: 3 Packages to be updated.
3 aur/orage 4.12.1-5 → 4.16.0-1
2 aur/python2-gobject2 2.28.7-6 → 2.28.7-7
1 aur/qt5-styleplugins 5.0.0.20170311-25 → 5.0.0.20170311-27
I have several questions. First of all, I would like to point out that all the packages indicated in this message have not been installed manually and I don’t know what they are for. They appeared only since the last update of Manjaro xfce. And before installing manually a AUR package, I check the installation source code to avoid malicious code. Also, very few applications are installed manually from AUR. But also, I am currently using the 5.10.109-1 kernel. Now that this is said, I can move on to the questions. To structure them well and clearly, numbering them is important; don’t think I’m taking you for robots or something, because I respect you and thank you in advance for your help. Come on, enough of bla, bla.
How is it possible that the pygtk package is newer than the package available on AUR?
The missing AUR packages worry me because I never installed them manually, I don’t know any except galculator-gtk2 which is the default calculator preinstalled on Manjaro xfce. So, is it normal that galculator-gtk2 seems to come from AUR?
Again, for the missing AUR packages, how do I know if I can safely uninstall them and if they are no longer needed?
Then, the libgee06 package is orphaned, how do I know if this is normal and if I can uninstall it if it is no longer needed?
Finally, the three packages to be updated, I never installed them manually, don’t know where they come from, nor what they are used for, etc., that worries me. Is it possible that these packages came from a core, extra, community, etc. repository and that since the system update, now they come from the AUR repository?
I agree. Before posting my message, I had wondered if there was an official communication or something about this, like with other previous updates. But, I couldn’t find anything.
The packages you talk about got removed from Arch Linux quite some time ago. We inherit that from their repository. Couple of packages are build by Manjaro but not those.
Once packages get removed from repositories is quite possible will be removed from AUR too.
The announcements always contain useful information and usually relates to all the changes, packages removed and packages added.
Here si an example regarding qt5-styleplugins
As @anon89812132 pointed out, most packages come upstream from Arch, and they regularly remove packages from their repositories. Those packages then end up in AUR.
Packages in the repositories (usually) cannot depend on AUR packages. The only case you might want to keep them is if you use an application from AUR with those packages as dependencies.
In most cases, orphaned packages are not required by any other package, and thus can be removed.
If some of these packages are indeed dependencies, how can I find out which packages are dependent on these dependencies? If there is a way, it would allow me to remove unnecessary dependencies safely.
Even if the risks are minimal, is there any way to be sure?
On the latest version of Manjaro xfce, I believe that pygtk has been replaced by pygobject. If so, pygobject is already installed on my system, so I can remove pygtk?
Simply try to remove the package. As dependencies shall be met at all times, the package manager will either try to remove other packages as well – and tell you which ones – or prevent you from removing it.
By executing the command of @NGr but with yay on all the packages of the topic, they do not seem to be required anymore, at least it is not indicated. For the suppression you advise me to do “yay -Rs” (pacman -Rs) or “yay -Rsn” (pacman -Rsn)? But if I understood correctly, the latter seems more risky but cleaner.
Except that yay shows me this message when checking the dependencies before confirming the supression:
:: checking dependencies…
:: gamin may require python2: for the python module
The cause of this message is pygtk. For information, gamin has not been installed manually. I don’t know gamin so I can’t tell if it uses python modules currently. Do you know what I should do?
I’ve been looking for information about gamin and according to some sites, gamin is a virus or works like a virus (it’s not very clear). I can’t find much information about it and it worries me. Is gamin really a virus?
AFAIK gamin was part of GNOME, and has been moved to AUR.
Also, since it is still in AUR, i highly doubt it is a virus. I mean, if someone finds out a package contains a virus, it should be removed from any repository before long!
Gamin on my system does not really seem to come from AUR but it is dependent for python modules on pygtk and that pygtk depends on python2-gobject2. From now on pygtk and python2-gobject2 are in the AUR repository. Yay indicates that gamin has been installed as a dependency but the box “Required by : --” is empty. By the way, you made me understand this earlier:
Thus, we have also seen that from now on gamin is only available in the AUR repository. All this suggests that gamin can also be deleted. What do you think?