paru shows you the PKGBUILD diffs on upgrade, so you can review then and deny upgrades.
But realistically I am not going to go into the code itself on my installed packages to check for malware or other types of attacks. That’s too time consuming for my risk level, and requires more knowledge than can be expected, to be honest.
Edit: but maybe you’re talking about when first installing a package? Come to think of it, I’m not sure it shows the PKGBUILD at that point. 🤔
the diff is noise in the potentially big update log. the point of doing it manually is forcing you to take your time and verify stuff one by one. also pkgbuild is just one place, seeing the hash changed means nothing if you don’t check what that archive contains, or seeing the install steps don’t change mean very little when the installer invokes other scripts anyway
i understand that you aren’t going to vet the source itself, but at that point you are exposing yourself to this kind of malware without mitigation. the aur is unsafe by design (fast way to publish a package without any involvement from anyone else) and should be avoided whenever possible. im not an arch hater, i too run arch
paru shows you the PKGBUILD diffs on upgrade, so you can review then and deny upgrades.
But realistically I am not going to go into the code itself on my installed packages to check for malware or other types of attacks. That’s too time consuming for my risk level, and requires more knowledge than can be expected, to be honest.
Edit: but maybe you’re talking about when first installing a package? Come to think of it, I’m not sure it shows the PKGBUILD at that point. 🤔
the diff is noise in the potentially big update log. the point of doing it manually is forcing you to take your time and verify stuff one by one. also pkgbuild is just one place, seeing the hash changed means nothing if you don’t check what that archive contains, or seeing the install steps don’t change mean very little when the installer invokes other scripts anyway
i understand that you aren’t going to vet the source itself, but at that point you are exposing yourself to this kind of malware without mitigation. the aur is unsafe by design (fast way to publish a package without any involvement from anyone else) and should be avoided whenever possible. im not an arch hater, i too run arch
It does, the diff shows the full files.