> Luckily for most packages this is reasonably doable, IFF you trust the upstream sources they fetch from.
Don't forgot to also check the applied patch files. Many AUR builds include custom patches to make something work, making this a convenient way add something malicious into the build.
An extreme example for patches is ventoy's 1355 line long PKGFILE [0] sourcing lots of patches both from external domains as well from the git server on aur.archlinux.org itself.
> Worse: it's a conversation killer. There's nothing to respond to. Your wall of text suppresses dialogue. They can't reply, can't push back, can't clarify. It's a weapon disguised as helpfulness.
Also my main problem with many chat bots. Too many different aspects brought up at once. Short answers would be more eco-friendly too.