On 10/28/26 11:08 AM, Jørgen Best wrote:
Hi there,
What I still don't get: if I see some other source than an upstream source, but
manual in this case.
How can I verify that the source is OK?
Do I have to check the complete package or is looking at the info with a Diff
sufficient?
What do I have to look for in the diff if the last is true. I only see local
sources/files.
Kind regards,
Jørgen
Having read the email thread again after writing my reply, it feels like an
XY-Problem: https://en.wikipedia.org/wiki/XY_problem
If you installed this package from [extra] back then, and an AUR helper is now
suggesting to update it from the AUR, the easiest solution is to just uninstall
the package if you don't explicitly need it:
pacman -R xfce4-artwork
---
Original reply:
I'm not sure what the diff is comparing against, but it shows Arch Linux
packaging files, that is different from the source code mentioned by Lone_Wolf
that's sometimes mirrored to sources.archlinux.org.
You can sometimes cross-reference the source code hash with other
distributions[1], or use a cryptographic signature, but it seems neither is
available (except a record that the official Arch Linux repositories have used
this source code in the past).
[1]:
https://whatsrc.org/artifact/sha256:7a97c0acd0ed67ebb871866cc79c2925bea45bf1b92442bd88fac390dbe639ac
The fact an Arch Linux staff member has put the source code on that server is
one data point for credibility, if that's sufficient for you personally is up to
you (there's no objective right or wrong).
cheers,
kpcyrd
