I determine within the PKGBUILD (which I view from octopi) the URLs where code or binaries are downloaded from and then if those URLs seem trustworthy, e.g. how many stars or maintainers the github repo has. When the repo is small and doesn’t qualify for the latter criterias, I do a git clone and skim over the sources on the lookout for malicious URLs or strange code (never found anything in that regard). Also search for the package on https://aur.archlinux.org/ and look if other users have anything to say and how many votes it has.
Is the PKGBUILD file the main source of truth? Like does every other file and URL it accesses get mentioned somewhere explicitly in there? (perhaps transitively)
Sort of, but I don’t know what I’m looking for. It would be nice if folks explained what a bad one looks like.
Look for comments that say “# THIS IS MALWARE”
I determine within the PKGBUILD (which I view from octopi) the URLs where code or binaries are downloaded from and then if those URLs seem trustworthy, e.g. how many stars or maintainers the github repo has. When the repo is small and doesn’t qualify for the latter criterias, I do a git clone and skim over the sources on the lookout for malicious URLs or strange code (never found anything in that regard). Also search for the package on https://aur.archlinux.org/ and look if other users have anything to say and how many votes it has.
Is the PKGBUILD file the main source of truth? Like does every other file and URL it accesses get mentioned somewhere explicitly in there? (perhaps transitively)