On Sat, 2026-08-08 at 19:45 +0000, doublemiu wrote: > Im not programmer but is there a way of making aur packages something > more a like reproducable? I mean dont let pkgbuild dowload and install > dependencies just check what are installed what are not, and force > user to install them manually so we know what are we installing ( like > istalling yay for first time). For me ideal situation would be > mandatory reproducability of aur packages forced on maintainer...am i > insane? If i understand good -bin packages are already compiled so is > there any tool i can use to check its 1 to 1 validity with code?
My opinion is that everyone makes mistakes and, for example, even when reviewing a PKGBUILD, can overlook something, therefore, it would be desirable to be able to use a tool before running makepkg that, if desired, assists in checking a PKGBUILD for malicious content. However, the core tools like makepkg shouldn’t be bloated, because users shouldn’t have to verify their own PKGBUILDs, and bloated scripts and programs can easily become gateways for malicious content themselves. I do think it’s appropriate to adapt the AUR and its tools to new circumstances to some extent, but anyone who is allowed to drive a car, manage a bank account without a guardian, and participate in democratic elections should also be able to act with a little bit of personal responsibility in all aspects of life. You don’t have to go to the trouble of using the AUR at all, even someone with limited knowledge can simply install packages from official repositories. It’s a shame, but that’s just how it is, assholes ruin everything beautiful, and on the World Wide Web, this has reached appalling proportions. The solution is social change, not an arms race and that applies to all conflicts, not just our AUR problem.
