pop each lace down one eyelet and you'll never have to untie them again if the heel is both sturdy and forgiving enough

Usually you concat them to form the GitHub tarball URL or similar, so on updates you only review the version/hash bumps, as on install you've validated the right GitHub organization/domain already.

Babashka has this for example (https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=babas...):

    pkgname=babashka-bin
    pkgver=1.13.219
    url='https://github.com/borkdude/babashka'
    source_x86_64=("${pkgname}-${pkgver}-linux-amd64-static.tar.gz::${url}/releases/download/v${pkgver}/${pkgname%-bin}-${pkgver}-linux-amd64-static.tar.gz")

AUR packages consist of packaging a third-party software (whether binary or source built as part of the package) for use on Arch.

Most updates are just bumping the upstream software version and its checksum, as GP describes, and yes arguably you should be reviewing the change to that software too, but that's a separate threat. And it may be a proprietary binary, in which case on update you've already decided to trust the third-party, so the diff shows you that nothing has changed in that regard, the trusted party simply released a new opaque version.

> doesn't have time to review the full diffs they're upgrading to.

Again, why are people expecting that you need to review the entire thing? You don't have to, you have to look at the download source (a github organization or a domain name or a cdn bucket) and look at what dependencies/other junk it pulls in. Usually this is 3-5 lines at max, and usually only the binary/source is taken from github/server, the rest is from official Arch repositories.

Of course it's unrealistic to expect users to review 100% of the code they run on their machine, that's why no one is expecting this, nor claiming that users should do this. But reviewing 3-5 lines when installing software from literal strangers on the internet, isn't so much to ask.

> It's already quite a technical barrier to run Arch Linux

People are supposed to clear that barrier by studying the Arch Wiki and other technical materials so that they understand what they are doing, why they are doing it, and the risks involved.

When they install random software pushed by random people they know nothing about much less trust without even so much as a glance at the PKGBUILD, they're not overcoming any barriers, they're YOLOing their personal computers and hoping it turns out fine.

> I wouldn't blame the user.

I would. They were warned.

> `curl https://random-website.com/script.sh | sh` is one of the most common way of installing software

Sure wish GitHub READMEs hadn't normalized this.

What PKGBUILD referencing official sources that been attacked would not be easily visible? The second the source changes away from official sources, you stop installing from it. It's one line you have to review, usually pointing to either a Github release or a CDN/download host under the official domain.

I can tell you misunderstand what the AUR actually is. It's not a package registry maintained by anyone, and it's also not limited to "build from source" or whatever. It's more like npm if anything, if you're familiar with that distribution mechanism.

Those users do look at the domain/URL though, where they are getting it from. The way to do that when using AUR, which they are explicit about, is to review the download source from PKGBUILD, which would be the same as a Windows user looking at the addressbar when they download something.

I know it's hard to believe, but many users, even Windows ones, actually check if they're on the right website/in the right GitHub organization, before downloading binaries.

> That would be every day that I run apt-get, pkg add, brew install, or download a random .exe/.dmg to update my machine.

Everything except that last part, are not "random strangers on the internet", those are maintainers who maintain the registry/repository you've chosen to use. And when you use those, they use "mirrors" hosted on their own infrastructure.

AUR is a very different thing from this, where essentially anyone, at any time, can become a "mirror" and host whatever code they want, with zero review.

I obviously don't review stuff when I use pacman and official Arch package repositories, because again, those aren't "Wild west of random binaries", like the AUR.

> Me. Who reads the source code of every program they run?

No one. Who codes their own operating systems before they launch a calculator on their own computer? No one as well. Why the irrelevant questions? They're all very different things.

You literally have to review one line, that points to a remote URL somewhere, that's it. If it's wrong/sus, don't install it, you don't even have to review more than that.

> Who reads the source code of every program they run?

Me. It's even easier now with AI.