Yes, Guix is initially a clone of Nix and has still remains of shared code (the build daemon).
Differences:
Guix packages are vetted.
AUR packages aren't.
And, package definitions in Guix are not shell scripts but highly abstracted functional installers that use the respective build tools of software packages. This makes them much easier to review - and quicker to write, in many cases.
Guix is also fully reproducible, and has the goal to provide safe distributely built software. (It gets significant hate from tech companies for requiring GPL licenses for the core distro, and thus not supporting binary code without source code).
As the case of the xz-utils package shows, this does not prevent that a widely used project is taken over by malicious actors, and stealthily malware becomes inserted. But the effort to do this is much larger, since this needs write access to the software's source code.
And no, I don't think Guix is the magical silver bullet for software security. But it is much better than unvetted shell scripts in AUR.
And of course, Guix has disadvantages, too. The biggest disadvantage is IMO that it is really slower than Arch's pacman, because Guix - being based on source packages - sometimes builds stuff from source. But I think this does not matter so much if one is using it for ten or twelve extra packages. (It also got a lot faster with moving to Codeberg.)
In Guix, package definitions are part of the Guix distro and are vetted.
(You can still add your own local package definitions, or pull a package definition of your schoolmates friend from their web site or Codeberg repo - Guix is very open in that sense. But, in the same way as with Ubuntu launchpad and ppa's or Debian third party repos, you would have to add that package source explicitly. It is not the standard way of distributing packages. )
Also, Guix is rapidly growing (31,000 packages despite it is relatively young). I think the reason is that it both allows for cross-language projects (If you want to publish a vector drawing program with image algorithm libraries written in C, a GUI done in in Python, and memory-safe media importers written in Rust - it is made for that!). And it runs on top of many larger distributions (I use it on Debian stable and Arch).
For people that just want to install packages that are not included in the Arch distro, and don't have the knowledge or time to review PKGBUILD files:
Have a look into the Guix package manager. It works fine on top of Arch, and Guix has 31,000 packages now. Great for cross-language development and also suitable for early sharing of projects. npm support is a bit weak though, but packages written in Python, Rust, or functional languages are well represented.
I think the AUR is great if you are writing some program, want to explore some idea, and want to share it with people you know. Sharing freely is how all open source software is created initially. Open source needs that openness and could not exist without the creativity which the openness makes possible. That's why Ubuntu for example has launchpad and ppas. But the AUR is not a good software distribution mechanism for people who just want to install and run stuff they have heard of, precisely because it is not vetted, and unsupervised. It can't because the sheer number of packages it includes, over 114,000 .
By aware that the next target could be the Python / PyPy / pip ecosystem and repos. It is unsupervised, too, and users on average are less technical than Arch users.
"pip install" can run arbitrary code on your computer.
I suggest Guix because it is more looked after. It also has, which is essential, the openness mentioned above: You can pull any Guix package definition from your friend's web site, and install it as any other package. You just need to configure the package source.
Have a look into the Guix package manager. It works fine on top of Arch, and Guix has 31,000 packages now. Great for cross-language development and also suitable for early sharing of projects. npm support is a bit weak though, but packages written in Python, Rust, or functional languages are well represented.
I fondly remember Jimmy Carter.
He had a vision - and it is winning all over the world.
By the way, he happened to be a nuclear safety expert, and was in office when the Three Mile Island reactor had an actual, barely contained, meltdown, and nearly exploded.
Are you aware how github works, or open source development in general ?
Some users are developers, too.
Some people write code, others may try it out, and a few of the latter might help with developing it. And some of these efforts become popular.
That's how we have Linux or KDE.
That's why Sourceforge was such a big win, why Ubuntu has launchpad and ppas, and why Arch has AUR.
It is all based on open sharing.
And of course you can opt to not run code that you don't know, or don't understand , or don't trust.
Isn’t the issue then that the official Arch repositories don’t have many packages .....?
Not at all. The official Arch distribution has tens of thousands of packages and the user repository / AUR probably more than 100,000 .
Edit: I looked it up:
But who would do that? Do you have security expertise and are volunteering to do that?
But this is exactly what the top comment of Cease talks about: There is no moderation team. You seem to think that it is the job of the maintainers of the Arch Linux distribution is to vet and review the AUR packages. But they take care for the - much more widely used - Arch distro packages and are busy with this. They have enough to do. And the AUR packages are not part of the Arch distro.
The AUR is basically a server where users can store their own packages so that others can use it. As its name says: Arch User Repository.
Yes, we need a kind of Debian for Python.
Part of the solution could be the Guix package manager. Part could be the commercial offerings, like Anaconda.
Guix is not a small distro any more and has a lot of support. Yes it has more packages than Arch - but this is hardly an argument against it. It is built on different principles compared to the Arch user repository - keeping control of the own computer was always a core goal of GNU, and this logically includes security from malware.