On Wed, 2026-10-28 at 17:32 +0100, Jørgen Best wrote: > is there an instruction on how to check AUR-packages/installs on > safety issues?
Hi, I don't know of any instructions, but it's clear that once you've downloaded the tarball from the AUR, you can check everything it contains yourself. Now, not everyone will be proficient in every programming language, or the source code might simply be far too extensive, but you still have the option of using only packages that rely on signed source code from upstream. Ultimately, of course, you have to trust upstream, and even with signed source code, that's still a bit of a gamble, see https://de.wikipedia.org/wiki/Web_of_Trust . Trusting upstream is also a hurdle because, for example, situations like https://en.wikipedia.org/wiki/PHP2Shell , https://de.wikipedia.org/wiki/XZ_Utils_Backdoor or https://de.wikipedia.org/wiki/Heartbleed ... can occur. I believe there's little you can do regarding packages other than looking at the diffs and the PKGBUILD. Given your security needs, you might be better off taking this approach: https://en.wikipedia.org/wiki/Hardening_(computing), particularly the part that states, "The attack surface is larger when a system performs more functions; in principle, a single-function system is more secure than a multipurpose one." Regards, Ralf
