Architecture and security models
yay is the most widely used Arch User Repository (AUR) helper, written in Go. It operates primarily as a command wrapper around `pacman` and `makepkg`, executing shell scripts to build community packages under the user’s account.
OMG is a multi-purpose systems and developer tool written in Rust. On Arch Linux, OMG connects directly to `libalpm` via compiled C bindings for package queries, parses `PKGBUILD` files using a custom pure-Rust parser without invoking a Bash interpreter, and builds AUR packages inside an unprivileged Bubblewrap (`bwrap`) sandbox.
While yay is strictly an Arch Linux package and AUR tool, OMG spans system packages (Arch ALPM, Debian/Ubuntu APT, Fedora DNF, and macOS Homebrew), 14 language runtimes, 54 developer CLI tools, and a polyglot task runner.
Direct technical comparison
Architectural and security comparison
| Dimension | OMG and yay |
|---|---|
| ALPM database integration | OMG links directly to `libalpm` in Rust for in-process database search and dependency resolution (10–100x faster than subprocess spawning). yay shells out to `pacman` binaries for many operations. |
| PKGBUILD metadata parsing | OMG parses PKGBUILDs in pure Rust (`src/package_managers/pkgbuild.rs`) with bounded memory (1MB limit) and `O_NOFOLLOW` protection against symlink attacks. yay executes bash subshells to parse recipes. |
| AUR build sandboxing | OMG builds AUR packages inside an isolated Bubblewrap container (`bwrap --clearenv --unshare-pid --new-session --die-with-parent`) with read-only root mounts (/usr, /etc) and isolated writable build dirs (`src/package_managers/aur/client.rs`). yay executes makepkg with direct access to $HOME and user secrets. |
| Privilege separation | OMG performs fetching, review, and building completely unprivileged, elevating via sudo only for the sealed package transaction. Sudo OMG is deprecated. yay prompts for sudo when makepkg requires dependency installation. |
| Attended security gates | OMG halts for explicit attended confirmation if an archive contains install hooks, setuid/setgid files, or Linux file capabilities; `-y` does not bypass these checks. yay has no equivalent install hook analysis. |
| Build caching | OMG maintains a hash-indexed build cache to avoid rebuilding unchanged AUR recipes across updates. yay stores sources in ~/.cache/yay but rebuilds when prompted. |
| Cross-platform and polyglot | OMG also manages language runtimes (Node, Python, Go, Rust, etc.), 54 developer tools, and polyglot tasks on Arch, Debian, Ubuntu, Fedora, and macOS. yay is exclusive to Arch Linux. |
How OMG’s Bubblewrap sandbox secures AUR builds
Because AUR packages are user-submitted scripts, executing `PKGBUILD` files with full access to your home directory presents serious security risks. A rogue or compromised `prepare()` or `build()` script could read SSH keys, access cloud credentials, or modify user shell configurations.
In `src/package_managers/aur/client.rs`, OMG enforces an unprivileged build sandbox using Linux Bubblewrap:
Pre-flight dependency resolution: official repository dependencies are resolved and installed before entering the sandbox.
Read-only root binds: /usr, /etc, /lib, and /lib64 are mounted read-only inside the container.
Isolated filesystem: the build process has no access to your $HOME directory, SSH keys, or personal files; only the build staging directory and /tmp are writable.
Process isolation: --clearenv strips environment variables, --unshare-pid isolates process namespaces, and --die-with-parent ensures child processes terminate with the build.
Privilege isolation: the untrusted build process receives no sudo-capable TTY and cannot elevate privileges.
When to choose OMG or yay
- Choose OMG if you prioritize security and want your AUR builds isolated from your home directory and SSH keys via Bubblewrap containers.
- Choose OMG if you want a single unified tool that manages Arch packages, AUR software, language runtimes (Node, Python, Go, Rust), and developer CLI tools (`ripgrep`, `starship`, `fzf`).
- Choose OMG if you run multiple Linux distributions (e.g. Arch desktop, Ubuntu server, Fedora workstation) and want identical commands and declarative environments across all machines.
- Choose yay if you rely on yay-specific interactive number-key selection menus or need to download unbuilt PKGBUILD trees via `yay -G`.
Sources and verification
Commands and behavior are based on the references below. Source review is not a claim that every workflow has been executed on every supported platform.
- OMG Arch Linux AUR client (src/package_managers/aur/client.rs)
- OMG PKGBUILD parser (src/package_managers/pkgbuild.rs)
- Arch Linux PKGBUILD specification
- Bubblewrap sandbox documentation