> What is the cost of Anubis for honest people?

I just made a post of one of the costs of Anubis for honest people before I saw your comment. Linking it here instead of copying: https://news.ycombinator.com/item?id=50358838

▲

Grombobulous 6 hours ago | parent [-]

Interesting, if I understand correctly it seems like Anubis is just being used in a use case inappropriate way here?

The Arch equivalent to this would be building AUR packages from source, which seems to universally work fine without any of these issues.

Are NixOS repos putting their source behind Anubis or something? I’m tempted to start on an “I don’t like NixOS” rant but I don’t know who owns these forges.

	▲	craftkiller 2 hours ago \| parent [-]
		It's sort of a mix between AUR and regular pacman repositories. On Arch, you have PKGBUILDs that list upstream URLs for your package sources. For example: https://gitlab.archlinux.org/archlinux/packaging/packages/ap... then some process takes those PKGBUILDs, downloads the sources from the upstream URLs, and builds them into the binary packages that end up in the official pacman repositories. The same process happens on NixOS to build their official repository (which is called the "Nix Binary Cache"). So most NixOS users, when installing software, they are just downloading prebuilt binary packages from official NixOS servers just like pacman does on Arch. I, however, disable the Nix's official package repository so when I install software it is like building from a PKGBUILD: it needs to download the sources from the upstream URL and build the package. I'd imagine the reason I run into this issue a lot more than you do is usually you only install a couple of packages from the AUR. The vast majority of your packages are going to come prebuilt from official Arch repositories. Whereas on my systems, 100% of the software is being built from source. So if any of my software is developed on a site using anubis to protect their source tarballs or patch files, I will hit this issue.