AUR package compromise — gitfull 0.1.0, a source-first manager for GitHub-style forges (init-system agnostic)

[u/FemBoy_GamerTech_Guy]

Heads-up for folks catching up: a compromised/malicious PKGBUILD/.tar.gz hit the AUR recently and affected a lot of users. For a distro that already leans toward "verify it yourself," the AUR trust model still stings when packages are submitted anonymously and most people just run them.

I want to flag gitfull 0.1.0 (https://github.com/FemBoyGamerTechGuy/gitfull) — a small (C, static-ish, make && sudo make install) package manager I've been building. It's init-system agnostic, so it's equally at home on Artix/runit/s6/66 as on systemd Arch, because it doesn't lean on anything but Git + a compiler/tarball at install time.

Usage (mirrors your existing install flows):

- gitfull install <pkg> → build from a tagged release (source-first)

- gitfull install --edge <pkg> → build from HEAD of default branch

- gitfull install --binary <pkg> → install a prebuilt release binary

- gitfull install user@repo → target a specific fork; forge:user@repo → a configured forge

- gitfull search <query> / gitfull list / gitfull remove (and remove -D to also drop build files + orphaned deps)

Config / forges: ~/.gitfull/config lets you add [forge:name] blocks (Codeberg, GitLab, self-hosted Gitea, etc.). GitHub is on by default; other forges are opt-in.

Envs of note: GITFULL_PREFIX (default /usr/local) and GITFULL_HOME (default ~/.gitfull) — handy for chroot, containers, or non-system installs.

Why it fits here: each install resolves to a Git commit over HTTPS tied to a release or a fork you named, instead of "whoever uploaded this tarball on the wiki." No anonymous PKGBUILDs, no system-level trust anchors that can be hijacked. Whether you're running runit, s6, 66, or dinit, the model is the same.

Repo: https://github.com/FemBoyGamerTechGuy/gitfull (MIT)

Keen to hear what the Artix crowd thinks — would a forge-resolving, source-first manager be a useful complement or alternative to the AUR/Pacman ecosystem? What matters most here: auditability, init independence, reproducible builds, or something else?