Transitive dependencies aren't the problem. C projects often have transitive dependencies twelve packages deep. The problem is that these languages have reposi

Transitive dependencies aren't the problem. C projects often have transitive dependencies twelve packages deep. The problem is that these languages have repositories are both free for all and have no consumer side vetting out of the box. Linux distributions have maintainers that vet the packages and that's why you can blindly download transitive dependencies with your OS package manager. But you can't do the same with the AUR. The AUR workflow requires you to actually read the PKGBUILD.