Reading PKGBUILD won't save you if you don't read the code or if the PKGBUILD installs a prebuilt bin. Same as Slackbuild or a third-party APT repository: you need to understand what a supply-chain attack is and do your duly work to prevent it, or stick with the consequences.

save

path: 0 25108599 25113075 25114294, hotness: undefined, score: 3, children: 6

Strit 6 points 2 months ago

But if you read the PKGBUILD, you would see that it downloads and runs a black-box binary and should therefore not install it. It's a little harder with PPAs I think. The build files are not so easily found.

save

path: 0 25108599 25113075 25114294 25114325, hotness: undefined, score: 6, children: 5

victorz 2 points 2 months ago

You never ever install a -bin package from the AUR?

save

path: 0 25108599 25113075 25114294 25114325 25115231, hotness: undefined, score: 2, children: 4

ScoffingLizard 1 point 2 months ago

He was maintaining Arch packages. I think all of them were main repo materials.

save

path: 0 25108599 25264387, hotness: undefined, score: 1, children: 0