Comment Comment by jchoksi AUR packages are user-produced content i.e. packages built on their own machines.They have to be installed via "pacman -U package_file"Arch developers can code "pacman -U" such that it performs a VirusTotal scan before installation for each package.VirusTotal's API is free.- https://docs.virustotal.com/docs/api-scripts-and-client-libr... - https://docs.virustotal.com/docs/please-give-me-an-api-key - https://docs.virustotal.com/docs/consumption-quotas-handledSince it is end users who are doing the upload and virus scan check, there won't be a consumption quota issue with VirusToal.Lastly, "pacman -U" should flag failed VirusTotal scans to Arch Security.Arch's pacman and Flathub's flatpak package managers should be the last line of defence when installing untrusted packages by end users. parent jchoksi 1 year ago
They have to be installed via "pacman -U package_file"
Arch developers can code "pacman -U" such that it performs a VirusTotal scan before installation for each package.
VirusTotal's API is free.
- https://docs.virustotal.com/docs/api-scripts-and-client-libr... - https://docs.virustotal.com/docs/please-give-me-an-api-key - https://docs.virustotal.com/docs/consumption-quotas-handled
Since it is end users who are doing the upload and virus scan check, there won't be a consumption quota issue with VirusToal.
Lastly, "pacman -U" should flag failed VirusTotal scans to Arch Security.
Arch's pacman and Flathub's flatpak package managers should be the last line of defence when installing untrusted packages by end users.