Reading PKGBUILD won’t save you if you don’t read the code or if the PKGBUILD installs a prebuilt bin.
Same as Slackbuild or a third-party APT repository: you need to understand what a supply-chain attack is and do your duly work to prevent it, or stick with the consequences.
don’t use the aur if you can’t read a PKGBUILD
Edit: And Kids remember to always check the diff when updating
Reading PKGBUILD won’t save you if you don’t read the code or if the PKGBUILD installs a prebuilt bin. Same as Slackbuild or a third-party APT repository: you need to understand what a supply-chain attack is and do your duly work to prevent it, or stick with the consequences.