Post #3331622

That’s not what a supply chain attack is. No part of Arch Linux or derivatives depend on AUR and you don’t have to use it. The attack simply highlights oversights in adoption of orphaned packages and those need to be addressed for sure. I have always tried to keep my AUR packages to a minimum (a few packages at most), and always read their PKGBUILDs and updates to them. Today, I don’t use any AUR package as all the ones I need are now packaged in official repos.