You missed the point of the AUR and that is okay

napcok · August 4, 2026, 12:58pm

Worth a read — especially for users spooked by that overly hyped AUR drama.

muzqs · August 5, 2026, 11:50am

I used the blog to setup a README on archcanay github.

I am not sure this is the final version yet.

docs/reading-pkgbuilds.md

master

# Reading a PKGBUILD (for people who've never done it)

You don't need to be a programmer to review a PKGBUILD safely. This page covers
what one actually is, its anatomy, and a practical reference of the red flags
that have shown up in real AUR attacks.

## Why this matters

AUR packages aren't pre-built, reviewed binaries like the ones in Arch's
official repos. A PKGBUILD is a Bash script anyone can upload, and it runs as
*you* the moment you build it — `yay -S`, `paru -S`, or `makepkg` by hand. If a
line downloads and runs a virus, or reads your SSH keys, nothing built into
Arch stops it. Reviewing the script before it runs is the only thing that
does.

This isn't hypothetical — AUR malware has happened more than once (see
[SOURCES.md](../SOURCES.md) for the documented incidents). The rest of this
page is about recognizing what to look for.

## Anatomy of a PKGBUILD

This file has been truncated. show original

Suggestions welcome