It’s the derivates leeching the arch aur infrastructure and preinstalling aur helpers suggesting it’s safe to use as is.

So, Arch users do not depend on AUR? If so, that's easy to fix. Just delete any mention of AUR from the Arch wiki.

Yeah you can go with Nix then.

But it is not by chance that Linux is based on Open Source hardeare support. The alternative is something like MacOS.

Nah, Guix is dead simple to use. I even trained my pet octopus to build Guix packages after it got bored with the underwater piano :)

Did you TeX 3.14159265359 ?

Don't forget that all the Arch users are doing a good part of that testing, too. Arch is a boon to Linux in general.

I never said that GitHub was better.

It is arguably harder to take over a package from github or Codeberg.

You could also serve your PKGBUILD from a Gemini server (the Gemini small-web protocol, not the Google AI which is really easy to administer and secure), and sign it with a PGP key. That would be about as secure without depending on a huge US American company.

Using Linux is not a dick measuring contest (and man I hate these threads asking "why is your distro the best?" - it feels like trolling and sowing division and grief to me. A bit like asking a mother "What is your favorite child?".)

But apart from that, I think we can all agree that security of AUR packages is no good enough, and that this deficit is by design.

Using Linux is not a dick measuring contest (and man I hate these threads asking "why is your distro the best?" - it feels like trolling and sowing division and grief to me. A bit like asking a mother "What is your favorite child?".)