How can I install an AUR that says it requires manual intervention?

[mbod]

I believe this is a good opportunity to come back to this “AUR Security discussion” where I made a statement about checking the source an AUR package is using:

So Just Anyone Can Make An AUR Package?

This whole discussion is basically telling everybody again that the AUR is anonymous. There are probably lots of bad guys with packages on the AUR and you dont know it. Knowing this “one guy” is just a good reminder about the overall threat level. The lesson learned is clear: Check the PKGBUILD before you install anything from the AUR.You do not need to be a programmer to do this. Just check the “source” and the “patches” which are being used to build the package. If you trust the source, then…

The screenshot from @Bink is a good illustration how that can work. The screenshot shows the thunderbird-beta-bin package resp. the corresponding PKGBUILD. A malicious packager could potentially use a modified thunderbird source code which would compromise your emails.

Check the source, Luke. In the PKGBUILD you see that it pulls the source directly from mozilla.org. That is good. And there do not seem to be any other sources which look suspicious. That is a first and very simple security check.