What exactly is PKGBUILD and should I edit it when installing packages?

Question

Whenever I use yaourt -Syua in my Manjaro Linux system, it'll give me

Edit PKGBUILD ? [Y/n] ("A" to abort)

and sometimes

Edit chromium-pepper-flash.install ? [Y/n] ("A" to abort)

Somewhere I read to just say no to editing these files.

The wiki : https://wiki.archlinux.org/index.php/PKGBUILD

Says the PKGBUILD is just some switches to alter when installing, so is it alright to just leave it default?

I haven't found information about the .install files, what are they?

Solution 1

Why don't you thoroughly read the wiki page that you linked:

Packages in Arch Linux are built using the makepkg utility and information stored in PKGBUILDs. When makepkg is run, it searches for a PKGBUILD in the current directory and follows the instructions therein to either compile or otherwise acquire the files to build a package file

Therefore, PKGBUILD is a "recipe" for creating a package (similar to a RPM spec, gentoo ebuild etc). Sometimes, when a package is installed/removed/upgraded, it may require some scripts/programs to be automatically executed before/after the package files are written to/removed from disk so an additional "recipe" is needed, i.e. .install (excerpt from the same link):

install

The name of the .install script to be included in the package. pacman has the ability to store and execute a package-specific script when it installs, removes or upgrades a package. The script contains the following functions which run at different times:

pre_install - The script is run right before files are extracted. One argument is passed: new package version.
post_install - The script is run right after files are extracted. One argument is passed: new package version.
pre_upgrade - The script is run right before files are extracted. Two arguments are passed in the following order: new package version, old package version.
post_upgrade - The script is run after files are extracted. Two arguments are passed in the following order: new package version, old package version.
pre_remove - The script is run right before files are removed. One argument is passed: old package version.
post_remove - The script is run right after files are removed. One argument is passed: old package version.

Usually, you edit PKGBUILD to customize the way the package is built (e.g. add/remove --configure options, change install prefix, patch the source code, exclude files from the package etc). Likewise, you edit .install to add or remove commands that should be automatically executed before/after a package install/upgrade/removal.
I'd say it's good practice to open those files when prompted and read their content just to make sure everything is OK.

Solution 2

If you want install a package that is available only from AUR, yaourt will download the desired package's PKGBUILD (and maybe some other files) and with PKGBUILD (the makepkg program) will build the package so you can install it.

If you'll need you can edit the PKGBUILD but I think in the most cases it's unnecessary. If you don't want this question (and always answer YES), you can do: place into /etc/yaourtrc the next line:

EDITFILES=0

I'm using some packages from AUR and I never needed to edit PKGBUILD.

Edit: this prevents only the question about editing PKGBUILD. You have chance of interrupt of installing unsupported packages from AUR and you can check PKGBUILD before building and installing of package.

Comments

[jasonwryan]

You are recommending that people install unsupported software without bothering to see what it is going to do. That is, IMO, irresponsible.

[uzsolt]

No, I didn't recommend this. I recommend that doesn't need edit PKGBUILD (most cases). With default yaourtrc and with my recommendation yaourt will ask if you want really build the package and really want to install, so you can choice answer "no" and check PKGBUILD.

[jasonwryan]

Then edit your answer to remove the recommendation to blindly install from the AUR...

[user2301506]

@jasonwryan You may not need to edit source code, either, and while it'd be great to read every line before installing anything, there is a point to where you end up having to trust trust. If you're not scrutinizing the source, then there's not really much more to lose by blindly accepting PKGBUILD.

[jasonwryan]

@SpellingD I couldn't disagree more: most open source projects have many sets of eyes on them; PKGBUILDs, on the other hand, do not. Anyone "blindly accepting" an anonymous and janky shell script with root access is a fool.