4 ms·
Afaik, upstream packages aren't changed by Arch maintainers. It's the whole point of using Arch. And if you're using AUR, you'd better be checking the PKGBUILD
by Sevaris 6y ago
Afaik, upstream packages aren't changed by Arch maintainers. It's the whole point of using Arch. And if you're using AUR, you'd better be checking the PKGBUILD (because no, it isn't verified by anybody). At the very least, you need to be checking where the package is being downloaded from.
- dathinab 6y agoThe PKGBUILD of packages in the official repository can be changed, which people theoretically could use to inject malware. That's what I meant.
- deleted 6y ago[deleted]