You really don't see the difference between a deterministic script installing a tarball pinned by its hash, and "sudo chatgpt install master branch of this repo"?

▲

warkdarrior 2 hours ago | parent [-]

Yes, the second option gives me an easily inspectable list of results (as I can see all the tool calls the model made). The deterministic script is probably overly complex and hard to read, maybe supports ten billion platform combinations.

▲

rcxdude 2 hours ago | parent | next [-]

Most PKGBUILDS are stupidly simple, they're probably easier to read than a set of tool calls. See this for a randomly picked recently updated example:

https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=batte...

(honestly I think the way that arch packages work is really nice compared to most other distros: you can almost copy and paste the README of a project into one and have a package)

Here's the most complicated one I found, building a browser:

https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=flowf...

The main risk, if you're reading them, is typosquatting and hiding the malicious code in what the project downloads.

▲

Matl 2 hours ago | parent | prev | next [-]

Arch is famously x64 only?

▲

tyfon 2 hours ago | parent [-]

I run it on my milk-v duo s risk sbc. The risk-v version is maintained by a few dedicated people, and the milk-v specifics I had to fix myself. But it works :)

	▲	Matl an hour ago \| parent [-]
		I knew there's an unofficial version for ARM. I meant more that the vast majority of AUR packages target x64 only because that's what 'official' Arch supports. That being said, didn't know there's a RISC V effort as well now, so TIL.

▲

ethin an hour ago | parent | prev [-]

> The deterministic script is probably overly complex and hard to read, maybe supports ten billion platform combinations.

Uh sorry what? Can you point to a PKGBUILD that is indeed this complex?