> But it could just as easily be malware

Everything that can be downloaded could easily be malware. No users verify binaries/compile from line-by-line verified source.

It's always about trust in author and distributor. Curl | bash or AUR or build from source - matters very little.

There’s a big difference between executing something from your package manager—and bluez is packaged by literally every major distribution—and executing:

a random binary from a brand new GitHub repo (which you didn’t build and can be swapped out for something evil any time)

…that’s actually a different project’s binary rebuilt and renamed/redistributed (or malware)

…as root

…on a hypervisor.

So yes,

> It's always about trust in author and distributor

Is totally correct. There are different levels of trust. This repo merits very low trust.