I suppose I should give the full story. I have checked them a few times, and two of which had their maintainers altered. Under the recent AUR attack, I believe that’s been a requirement for malicious alterations to seep in, yet I don’t entirely know what the malicious alterations look like in code. Three of the four packages ship default with CachyOS, with the stray one being added by myself. Conveniently enough, the one I added myself is the one I trust the most and actually feel confident enough in my auditing of.
As for removing unnecessary packages, yeah that’s a fair point. Much as I like Cachy for being an easy-to-use Arch based distro, it does bring a handful of bloat with it. Suppose I’ve just been afraid I’d be removing a dependency.
If you use the usual pacman -Rns you can’t accidentally remove a dependency. Pacman will warn you about that
For the last attacks, packages just has additional commands running some JS installer. The best way of being sure is reading and understanding the full PKGBUILD and then checking the diffs. In most cases only the version and SHA sums should change on an update.
I suppose I should give the full story. I have checked them a few times, and two of which had their maintainers altered. Under the recent AUR attack, I believe that’s been a requirement for malicious alterations to seep in, yet I don’t entirely know what the malicious alterations look like in code. Three of the four packages ship default with CachyOS, with the stray one being added by myself. Conveniently enough, the one I added myself is the one I trust the most and actually feel confident enough in my auditing of.
As for removing unnecessary packages, yeah that’s a fair point. Much as I like Cachy for being an easy-to-use Arch based distro, it does bring a handful of bloat with it. Suppose I’ve just been afraid I’d be removing a dependency.
If you use the usual
pacman -Rnsyou can’t accidentally remove a dependency. Pacman will warn you about thatFor the last attacks, packages just has additional commands running some JS installer. The best way of being sure is reading and understanding the full PKGBUILD and then checking the diffs. In most cases only the version and SHA sums should change on an update.