Arch is fine, just don't use the AUR unless you are prepared to validate the PKGBUILD.
Personally, I only use AUR packages that just wrap binaries from well known sources, the only thing that should change in the diff is the sha256 and the version string which makes re-validating them after an update only take a few seconds.
Personally, I only use AUR packages that just wrap binaries from well known sources, the only thing that should change in the diff is the sha256 and the version string which makes re-validating them after an update only take a few seconds.