Hacker News new | ask | show | jobs
by fantyoon 2 hours ago
PKGBUILDs are more powerful than that. They might download dependencies for the build from a package registry like npm, pypi, or crates, they might download and apply patches, and run arbitrary build scripts.

Changes to some of that might be easy to catch, but if the PKGBUILD depends on external resources, it can be quite hard to audit. I am not saying this is good practice, but you can see these sort of things happen all the time on the AUR.
2 comments
embedding-shape 2 hours ago
Yes, indeed they might, but if you start seeing sketchy stuff like that, then don't continue, I'm not sure I understand what's hard here. Or do continue, but then if those are AUR packages themselves, review them as such. Personally I just ignore anything not built from official binaries/sources.

If the PKGBUILD depends on more stuff then just officially available things, don't blindly install it and wish for the best. Just like if you "curl | bash" install something, you do at least look at the URL right? It takes a couple of seconds, maybe tens of seconds if you don't recognize the domain/github organization since before.

link
bondarchuk 2 hours ago
Ah but you switched now from "I don't think people do this" to "people shouldn't do this". You're right about the latter but wrong about the former.
link
embedding-shape 2 hours ago
Yes, contrary to popular belief, even I am affected by context and change what I converse about as the discussions topic and context drift, this is called having a conversation.

I'll stand by that I think most Arch Linux users, extrapolated from the people I know also run it, review at least the domain/GitHub organization for random AUR packages, and all of them are aware of what the AUR actually is, and is for.

I don't think most people here on HN who are clearly misunderstanding what the AUR is, are actually Arch users, or if they are, they haven't read the header that been visible since forever on the AUR.

link
matheusmoreira 2 hours ago
> dependencies for the build from a package registry like npm, pypi, or crates, it might download and apply patches, and run arbitrary build scripts

You're supposed to review every single one of those too.

link