5 ms·

> did you not even review the PKGBUILD or anything else before installing stuff from the AUR? I'd venture most people actually don't review pkgbuild; especiall

by dijit 2mo ago

> did you not even review the PKGBUILD or anything else before installing stuff from the AUR? I'd venture most people actually don't review pkgbuild; especially on upgrades. The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no compilation) then you're boned. You can even hide nefarious code in the compilation/build steps, Jia Tan style.

embedding-shape 2mo ago
> I'd venture most people actually don't review pkgbuild; especially on upgrades. No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? > The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no compilation) then you're boned. Sure, that's why when you review the PKGBUILD, and instead of it using the official GitHub organization / domain (which you of course validate) for downloading the binary/source, you don't install it. I agree it's still vulnerable to Jia Tan style attacks, but installing from AUR is essentially "curl http://random-website.com/script.sh http://random-website.com/script.sh | bash", and reviewing a PKGBUILD takes a few seconds, and stop/cancel if something is sus, it's really that easy.
- fantyoon 2mo ago
  > No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? I would assume essentially everyone? `curl https://random-website.com/script.sh https://random-website.com/script.sh | sh` is one of the most common way of installing software outside of perhaps Flatpak. AppImage is essentially the same as piping a script from the internet into bash. > reviewing a PKGBUILD takes a few seconds This assumes a naive attack that is easily visible from the PKGBUILD. Unless the attacker makes no effort to hide their activity, the PKGBUILD will look perfectly ordinary while still installing malware.
  - embedding-shape 2mo ago
    What PKGBUILD referencing official sources that been attacked would not be easily visible? The second the source changes away from official sources, you stop installing from it. It's one line you have to review, usually pointing to either a Github release or a CDN/download host under the official domain.
    - fantyoon 2mo ago
      PKGBUILDs are more powerful than that. They might download dependencies for the build from a package registry like npm, pypi, or crates, they might download and apply patches, and run arbitrary build scripts. Changes to some of that might be easy to catch, but if the PKGBUILD depends on external resources, it can be quite hard to audit. I am not saying this is good practice, but you can see these sort of things happen all the time on the AUR.
      - matheusmoreira 2mo ago
        > dependencies for the build from a package registry like npm, pypi, or crates, it might download and apply patches, and run arbitrary build scripts You're supposed to review every single one of those too.
      - embedding-shape 2mo ago
        Yes, indeed they might, but if you start seeing sketchy stuff like that, then don't continue, I'm not sure I understand what's hard here. Or do continue, but then if those are AUR packages themselves, review them as such. Personally I just ignore anything not built from official binaries/sources. If the PKGBUILD depends on more stuff then just officially available things, don't blindly install it and wish for the best. Just like if you "curl | bash" install something, you do at least look at the URL right? It takes a couple of seconds, maybe tens of seconds if you don't recognize the domain/github organization since before.
        bondarchuk 2mo ago
- unethical_ban 2mo ago
  Me. Who reads the source code of every program they run? I've learned not to trust the AUR because the barrier to malice is lower, but I run system updates every other day.
  - embedding-shape 2mo ago
    > Me. Who reads the source code of every program they run? No one. Who codes their own operating systems before they launch a calculator on their own computer? No one as well. Why the irrelevant questions? They're all very different things. You literally have to review one line, that points to a remote URL somewhere, that's it. If it's wrong/sus, don't install it, you don't even have to review more than that.
    - unethical_ban 2mo ago
      Thank you for explaining, since in the year-plus of using Arch that has never been shown in a tutorial or in the OS itself. "paru <package>" is all I've known, and the AUR wiki makes it sounds like 15 steps of compile from source.
  - matheusmoreira 2mo ago
    > Who reads the source code of every program they run? Me. It's even easier now with AI.
    - dwedge 2mo ago
      So, you don't.
      - matheusmoreira 2mo ago
        Have been reading source code for over 15 years now. I read the source code of a lot of software, just for curiosity's sake. I go out of my way to read the source code of random scripts I find laying about and that I want to run, and I do so before running them. PKGBUILDs are in that category, as are random scripts people throw on GitHub. Only difference is now I ask AI models to read the source too. Chances of malware slipping by both myself and AI is lower than it slipping by either in isolation.
- dijit 2mo ago
  > No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? That would be every day that I run apt-get, pkg add, brew install, or download a random .exe/.dmg to update my machine. A decade of telling people that if they don't update constantly they're at risk, also affects us computer people. Being able (and willing) to inspect source tree is the exception here, not the standard.
  - embedding-shape 2mo ago
    > That would be every day that I run apt-get, pkg add, brew install, or download a random .exe/.dmg to update my machine. Everything except that last part, are not "random strangers on the internet", those are maintainers who maintain the registry/repository you've chosen to use. And when you use those, they use "mirrors" hosted on their own infrastructure. AUR is a very different thing from this, where essentially anyone, at any time, can become a "mirror" and host whatever code they want, with zero review. I obviously don't review stuff when I use pacman and official Arch package repositories, because again, those aren't "Wild west of random binaries", like the AUR.
    - DavideNL 2mo ago
      I get the impression many of the commenters either don’t know what the AUR is, or have no idea how it works (the AUR guidelines are on top of the front page…) The latter might be a problem caused by hosting it on the archlinux.org domain: it creates a *feeling* of trust, for the uninitiated.
      - matheusmoreira 2mo ago
        > for the uninitiated Arch Linux is not for the uninitiated.
      - embedding-shape 2mo ago
        > I get the impression many of the commenters either don’t know what the AUR is, or have no idea how it works (the AUR guidelines are on top of the front page…) Yup, 100%. Probably I've spent way too long time trying to make people (in the various AUR submissions here on HN) realize that the AUR probably isn't what they think it is, as most replies/comments about the AUR seems misinformed about what it is for and how it works.
- estimator7292 2mo ago
  [dead]
- dwedge 2mo ago
  > No, I'm sorry but who on earth installs random software from random strangers Everyone. People who don't tend to build from source and the convenience of package managers has outweighed this for most people for years now. Even if you review the code do you review every library it pulls in? Because I have to tell you I don't believe you, and if most people did do that then these supply chain attacks would be minor news.
  - embedding-shape 2mo ago
    I can tell you misunderstand what the AUR actually is. It's not a package registry maintained by anyone, and it's also not limited to "build from source" or whatever. It's more like npm if anything, if you're familiar with that distribution mechanism.
    - dwedge 2mo ago
      I misunderstood your comment more and in that case I apologise. I thought you meant you review all packages you install or upgrade from any source. In my case I'm guilty of not checking brew updates (even from casks) on Mac, but I'm also guilty of only updating them every couple of months so it probably balances out.
    - matheusmoreira 2mo ago
      > It's more like npm if anything, if you're familiar with that distribution mechanism. True, but I'd reverse the order. It's npm, pip, cargo, gem and all the others that are like the AUR. They're every bit as dangerous as the AUR, yet the AUR is the only one that singles itself out by warning people of the danger. Anyone can sign up and push packages. I've literally done that myself, even though nobody in the Arch Linux community knows or trusts me. AUR is the only one where users are repeatedly made aware of this danger. All the others normalize and encourage importing random unvetted dependencies for the sake of developer convenience.
      - preg_match 2mo ago
        Yes, and this is why npm is never installed on my hosts. Folks podman is good. Very, very good. You want good developer ergonomics? Use dev containers. The cost of pulling npm packages Willy nilly on the host is not worth it!
- cyberclimb 2mo ago
  > No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access... Realistically most users? It's already quite a technical barrier to run Arch Linux, and the knowledge to further know about/understand PKGBUILD can only comes with time and is yet another layer filtering people's ability to know how to even try to catch something malicious. Now consider the layer of even experienced user that's in a bit of rush and doesn't have time to review the full diffs they're upgrading to. Ralistically it's nearly statistically impossible that 100% of users would be able to all catch and block a given exploit themselves. A shared responsibility model of security [1] comes to mind, and while it's great for users to be active participants in their security, their action/awareness should be a last resort. I wouldn't blame the user. [1] https://docs.cloud.google.com/architecture/framework/security/shared-responsibility-shared-fate?hl=pt-br https://docs.cloud.google.com/architecture/framework/securit...
  - embedding-shape 2mo ago
    > doesn't have time to review the full diffs they're upgrading to. Again, why are people expecting that you need to review the entire thing? You don't have to, you have to look at the download source (a github organization or a domain name or a cdn bucket) and look at what dependencies/other junk it pulls in. Usually this is 3-5 lines at max, and usually only the binary/source is taken from github/server, the rest is from official Arch repositories. Of course it's unrealistic to expect users to review 100% of the code they run on their machine, that's why no one is expecting this, nor claiming that users should do this. But reviewing 3-5 lines when installing software from literal strangers on the internet, isn't so much to ask.
    - kalenx 2mo ago
      Many packages are _way_ more complex than 3-5 lines to review. To take an example (perhaps a bit extreme, but realistic as many nVidia users _have_ to install it), check nvidia-580xx-dkms Every patch (which runs in kernel space) may of course contain backdoors, so you'd have to review them. Every install line in the PKGBUILD may be installing a malware. Of course it is _possible_ to review all of it, but clearly not simple, even for a fairly technical user. Sure, if you assume that every attack would be as glaring as the ones we've seen before, that makes it easier. But think of an attack at the level of the xz one and virtually no one would catch it.
- preg_match 2mo ago
  > No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? Well, for one almost everyone on Windows. That’s changing with winget and such but the standard Linux method is still an anomaly in desktop computing as a whole.
  - embedding-shape 2mo ago
    Those users do look at the domain/URL though, where they are getting it from. The way to do that when using AUR, which they are explicit about, is to review the download source from PKGBUILD, which would be the same as a Windows user looking at the addressbar when they download something. I know it's hard to believe, but many users, even Windows ones, actually check if they're on the right website/in the right GitHub organization, before downloading binaries.
- ThePowerOfFuet 2mo ago
  > No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? I personally know nobody on either the Fedora or KDE teams. So I shouldn't do my banking on my Fedora KDE box?
  - embedding-shape 2mo ago
    It'd have been hard for anyone else to make it clearer to other's, that you don't actually understand what the AUR is nor how PKGBUILDs work. I'm not saying people should review the code/source/binary itself, I'm saying that people do tend to look at the URL/domain at least once, a glance, before installing binaries.
nvme0n1p1 2mo ago
Why especially upgrades? Upgrades are way easier to review than new installs. Most diffs I see are just these two lines: -pkgver=1.7.2 +pkgver=1.7.3 -sha256sums=('aaaaaaaaaa') +sha256sums=('bbbbbbbbbb') It takes like 5 seconds to read and press Y.
- dijit 2mo ago
  Cool theory, but the same reason I pull my shoes off by standing on my heel and pulling, despite it saving me no time (I will have to untie them anyway when I put them on again). Humans are short sighted, want to solve the situation immediately and will do the laziest thing possible to accomplish a given task.
  - 0gs 2mo ago
    pop each lace down one eyelet and you'll never have to untie them again if the heel is both sturdy and forgiving enough
    - inversepolymath 2mo ago
      yeah but then it doesn't feel 'right'
- dwedge 2mo ago
  Call me naive (I don't use arch) but if that's the only change then what's the point releasing the change? Unless pkgver refers to an external dependency or a binary, in which case you might as well say reading the changelog counts as reading the code
  - embedding-shape 2mo ago
    Usually you concat them to form the GitHub tarball URL or similar, so on updates you only review the version/hash bumps, as on install you've validated the right GitHub organization/domain already. Babashka has this for example (https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=babashka-bin https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=babas...): pkgname=babashka-bin pkgver=1.13.219 url='https://github.com/borkdude/babashka' source_x86_64=("${pkgname}-${pkgver}-linux-amd64-static.tar.gz::${url}/releases/download/v${pkgver}/${pkgname%-bin}-${pkgver}-linux-amd64-static.tar.gz") So on install, you review ideally everything, but at least the URL/organization/domain. Then on updates, you've already validated them, so the pkgver bump is the only thing of interest.

by dijit 2mo ago

embedding-shape 2mo ago

> I'd venture most people actually don't review pkgbuild; especially on upgrades. No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? > The other issue of course is that, the devils in the details. Fetch a binary as part of the installation (or, just fetch a binary itself, no compilation) then you're boned. Sure, that's why when you review the PKGBUILD, and instead of it using the official GitHub organization / domain (which you of course validate) for downloading the binary/source, you don't install it. I agree it's still vulnerable to Jia Tan style attacks, but installing from AUR is essentially "curl http://random-website.com/script.sh http://random-website.com/script.sh | bash", and reviewing a PKGBUILD takes a few seconds, and stop/cancel if something is sus, it's really that easy.

fantyoon 2mo ago
> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? I would assume essentially everyone? `curl https://random-website.com/script.sh https://random-website.com/script.sh | sh` is one of the most common way of installing software outside of perhaps Flatpak. AppImage is essentially the same as piping a script from the internet into bash. > reviewing a PKGBUILD takes a few seconds This assumes a naive attack that is easily visible from the PKGBUILD. Unless the attacker makes no effort to hide their activity, the PKGBUILD will look perfectly ordinary while still installing malware.
- embedding-shape 2mo ago
  What PKGBUILD referencing official sources that been attacked would not be easily visible? The second the source changes away from official sources, you stop installing from it. It's one line you have to review, usually pointing to either a Github release or a CDN/download host under the official domain.
  - fantyoon 2mo ago
    PKGBUILDs are more powerful than that. They might download dependencies for the build from a package registry like npm, pypi, or crates, they might download and apply patches, and run arbitrary build scripts. Changes to some of that might be easy to catch, but if the PKGBUILD depends on external resources, it can be quite hard to audit. I am not saying this is good practice, but you can see these sort of things happen all the time on the AUR.
    - matheusmoreira 2mo ago
      > dependencies for the build from a package registry like npm, pypi, or crates, it might download and apply patches, and run arbitrary build scripts You're supposed to review every single one of those too.
    - embedding-shape 2mo ago
      Yes, indeed they might, but if you start seeing sketchy stuff like that, then don't continue, I'm not sure I understand what's hard here. Or do continue, but then if those are AUR packages themselves, review them as such. Personally I just ignore anything not built from official binaries/sources. If the PKGBUILD depends on more stuff then just officially available things, don't blindly install it and wish for the best. Just like if you "curl | bash" install something, you do at least look at the URL right? It takes a couple of seconds, maybe tens of seconds if you don't recognize the domain/github organization since before.
      - bondarchuk 2mo ago
unethical_ban 2mo ago
Me. Who reads the source code of every program they run? I've learned not to trust the AUR because the barrier to malice is lower, but I run system updates every other day.
- embedding-shape 2mo ago
  > Me. Who reads the source code of every program they run? No one. Who codes their own operating systems before they launch a calculator on their own computer? No one as well. Why the irrelevant questions? They're all very different things. You literally have to review one line, that points to a remote URL somewhere, that's it. If it's wrong/sus, don't install it, you don't even have to review more than that.
  - unethical_ban 2mo ago
    Thank you for explaining, since in the year-plus of using Arch that has never been shown in a tutorial or in the OS itself. "paru <package>" is all I've known, and the AUR wiki makes it sounds like 15 steps of compile from source.
- matheusmoreira 2mo ago
  > Who reads the source code of every program they run? Me. It's even easier now with AI.
  - dwedge 2mo ago
    So, you don't.
    - matheusmoreira 2mo ago
      Have been reading source code for over 15 years now. I read the source code of a lot of software, just for curiosity's sake. I go out of my way to read the source code of random scripts I find laying about and that I want to run, and I do so before running them. PKGBUILDs are in that category, as are random scripts people throw on GitHub. Only difference is now I ask AI models to read the source too. Chances of malware slipping by both myself and AI is lower than it slipping by either in isolation.
dijit 2mo ago
> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? That would be every day that I run apt-get, pkg add, brew install, or download a random .exe/.dmg to update my machine. A decade of telling people that if they don't update constantly they're at risk, also affects us computer people. Being able (and willing) to inspect source tree is the exception here, not the standard.
- embedding-shape 2mo ago
  > That would be every day that I run apt-get, pkg add, brew install, or download a random .exe/.dmg to update my machine. Everything except that last part, are not "random strangers on the internet", those are maintainers who maintain the registry/repository you've chosen to use. And when you use those, they use "mirrors" hosted on their own infrastructure. AUR is a very different thing from this, where essentially anyone, at any time, can become a "mirror" and host whatever code they want, with zero review. I obviously don't review stuff when I use pacman and official Arch package repositories, because again, those aren't "Wild west of random binaries", like the AUR.
  - DavideNL 2mo ago
    I get the impression many of the commenters either don’t know what the AUR is, or have no idea how it works (the AUR guidelines are on top of the front page…) The latter might be a problem caused by hosting it on the archlinux.org domain: it creates a *feeling* of trust, for the uninitiated.
    - matheusmoreira 2mo ago
      > for the uninitiated Arch Linux is not for the uninitiated.
    - embedding-shape 2mo ago
      > I get the impression many of the commenters either don’t know what the AUR is, or have no idea how it works (the AUR guidelines are on top of the front page…) Yup, 100%. Probably I've spent way too long time trying to make people (in the various AUR submissions here on HN) realize that the AUR probably isn't what they think it is, as most replies/comments about the AUR seems misinformed about what it is for and how it works.
estimator7292 2mo ago
[dead]
dwedge 2mo ago
> No, I'm sorry but who on earth installs random software from random strangers Everyone. People who don't tend to build from source and the convenience of package managers has outweighed this for most people for years now. Even if you review the code do you review every library it pulls in? Because I have to tell you I don't believe you, and if most people did do that then these supply chain attacks would be minor news.
- embedding-shape 2mo ago
  I can tell you misunderstand what the AUR actually is. It's not a package registry maintained by anyone, and it's also not limited to "build from source" or whatever. It's more like npm if anything, if you're familiar with that distribution mechanism.
  - dwedge 2mo ago
    I misunderstood your comment more and in that case I apologise. I thought you meant you review all packages you install or upgrade from any source. In my case I'm guilty of not checking brew updates (even from casks) on Mac, but I'm also guilty of only updating them every couple of months so it probably balances out.
  - matheusmoreira 2mo ago
    > It's more like npm if anything, if you're familiar with that distribution mechanism. True, but I'd reverse the order. It's npm, pip, cargo, gem and all the others that are like the AUR. They're every bit as dangerous as the AUR, yet the AUR is the only one that singles itself out by warning people of the danger. Anyone can sign up and push packages. I've literally done that myself, even though nobody in the Arch Linux community knows or trusts me. AUR is the only one where users are repeatedly made aware of this danger. All the others normalize and encourage importing random unvetted dependencies for the sake of developer convenience.
    - preg_match 2mo ago
      Yes, and this is why npm is never installed on my hosts. Folks podman is good. Very, very good. You want good developer ergonomics? Use dev containers. The cost of pulling npm packages Willy nilly on the host is not worth it!
cyberclimb 2mo ago
> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access... Realistically most users? It's already quite a technical barrier to run Arch Linux, and the knowledge to further know about/understand PKGBUILD can only comes with time and is yet another layer filtering people's ability to know how to even try to catch something malicious. Now consider the layer of even experienced user that's in a bit of rush and doesn't have time to review the full diffs they're upgrading to. Ralistically it's nearly statistically impossible that 100% of users would be able to all catch and block a given exploit themselves. A shared responsibility model of security [1] comes to mind, and while it's great for users to be active participants in their security, their action/awareness should be a last resort. I wouldn't blame the user. [1] https://docs.cloud.google.com/architecture/framework/security/shared-responsibility-shared-fate?hl=pt-br https://docs.cloud.google.com/architecture/framework/securit...
- embedding-shape 2mo ago
  > doesn't have time to review the full diffs they're upgrading to. Again, why are people expecting that you need to review the entire thing? You don't have to, you have to look at the download source (a github organization or a domain name or a cdn bucket) and look at what dependencies/other junk it pulls in. Usually this is 3-5 lines at max, and usually only the binary/source is taken from github/server, the rest is from official Arch repositories. Of course it's unrealistic to expect users to review 100% of the code they run on their machine, that's why no one is expecting this, nor claiming that users should do this. But reviewing 3-5 lines when installing software from literal strangers on the internet, isn't so much to ask.
  - kalenx 2mo ago
    Many packages are _way_ more complex than 3-5 lines to review. To take an example (perhaps a bit extreme, but realistic as many nVidia users _have_ to install it), check nvidia-580xx-dkms Every patch (which runs in kernel space) may of course contain backdoors, so you'd have to review them. Every install line in the PKGBUILD may be installing a malware. Of course it is _possible_ to review all of it, but clearly not simple, even for a fairly technical user. Sure, if you assume that every attack would be as glaring as the ones we've seen before, that makes it easier. But think of an attack at the level of the xz one and virtually no one would catch it.
preg_match 2mo ago
> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? Well, for one almost everyone on Windows. That’s changing with winget and such but the standard Linux method is still an anomaly in desktop computing as a whole.
- embedding-shape 2mo ago
  Those users do look at the domain/URL though, where they are getting it from. The way to do that when using AUR, which they are explicit about, is to review the download source from PKGBUILD, which would be the same as a Windows user looking at the addressbar when they download something. I know it's hard to believe, but many users, even Windows ones, actually check if they're on the right website/in the right GitHub organization, before downloading binaries.
ThePowerOfFuet 2mo ago
> No, I'm sorry but who on earth installs random software from random strangers, without a single step of validating before giving it access to (presumably) the same computer you do banking on? I personally know nobody on either the Fedora or KDE teams. So I shouldn't do my banking on my Fedora KDE box?
- embedding-shape 2mo ago
  It'd have been hard for anyone else to make it clearer to other's, that you don't actually understand what the AUR is nor how PKGBUILDs work. I'm not saying people should review the code/source/binary itself, I'm saying that people do tend to look at the URL/domain at least once, a glance, before installing binaries.

nvme0n1p1 2mo ago

Why especially upgrades? Upgrades are way easier to review than new installs. Most diffs I see are just these two lines: -pkgver=1.7.2 +pkgver=1.7.3 -sha256sums=('aaaaaaaaaa') +sha256sums=('bbbbbbbbbb') It takes like 5 seconds to read and press Y.

dijit 2mo ago
Cool theory, but the same reason I pull my shoes off by standing on my heel and pulling, despite it saving me no time (I will have to untie them anyway when I put them on again). Humans are short sighted, want to solve the situation immediately and will do the laziest thing possible to accomplish a given task.
- 0gs 2mo ago
  pop each lace down one eyelet and you'll never have to untie them again if the heel is both sturdy and forgiving enough
  - inversepolymath 2mo ago
    yeah but then it doesn't feel 'right'
dwedge 2mo ago
Call me naive (I don't use arch) but if that's the only change then what's the point releasing the change? Unless pkgver refers to an external dependency or a binary, in which case you might as well say reading the changelog counts as reading the code
- embedding-shape 2mo ago
  Usually you concat them to form the GitHub tarball URL or similar, so on updates you only review the version/hash bumps, as on install you've validated the right GitHub organization/domain already. Babashka has this for example (https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=babashka-bin https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=babas...): pkgname=babashka-bin pkgver=1.13.219 url='https://github.com/borkdude/babashka' source_x86_64=("${pkgname}-${pkgver}-linux-amd64-static.tar.gz::${url}/releases/download/v${pkgver}/${pkgname%-bin}-${pkgver}-linux-amd64-static.tar.gz") So on install, you review ideally everything, but at least the URL/organization/domain. Then on updates, you've already validated them, so the pkgver bump is the only thing of interest.