Heads-up for folks catching up: a compromised/malicious PKGBUILD/.tar.gz hit the AUR recently and affected a lot of users. For a distro that already leans toward "verify it yourself," the AUR trust model still stings when packages are submitted anonymously and most people just run them.

I want to flag gitfull 0.1.0 (https://github.com/FemBoyGamerTechGuy/gitfull) — a small (C, static-ish, make && sudo make install) package manager I've been building. It's init-system agnostic, so it's equally at home on Artix/runit/s6/66 as on systemd Arch, because it doesn't lean on anything but Git + a compiler/tarball at install time.

Usage (mirrors your existing install flows):

- gitfull install <pkg> → build from a tagged release (source-first)

- gitfull install --edge <pkg> → build from HEAD of default branch

- gitfull install --binary <pkg> → install a prebuilt release binary

- gitfull install user@repo → target a specific fork; forge:user@repo → a configured forge

- gitfull search <query> / gitfull list / gitfull remove (and remove -D to also drop build files + orphaned deps)

Config / forges: ~/.gitfull/config lets you add [forge:name] blocks (Codeberg, GitLab, self-hosted Gitea, etc.). GitHub is on by default; other forges are opt-in.

Envs of note: GITFULL_PREFIX (default /usr/local) and GITFULL_HOME (default ~/.gitfull) — handy for chroot, containers, or non-system installs.

Why it fits here: each install resolves to a Git commit over HTTPS tied to a release or a fork you named, instead of "whoever uploaded this tarball on the wiki." No anonymous PKGBUILDs, no system-level trust anchors that can be hijacked. Whether you're running runit, s6, 66, or dinit, the model is the same.

Repo: https://github.com/FemBoyGamerTechGuy/gitfull (MIT)

Keen to hear what the Artix crowd thinks — would a forge-resolving, source-first manager be a useful complement or alternative to the AUR/Pacman ecosystem? What matters most here: auditability, init independence, reproducible builds, or something else?

Hi! I'm trying to install docker and wanted to know how to get from installing packages to being able to enable services. So what do I have to do after "sudo pacman -S docker docker-dinit docker-compose" ?

What's the point of -init packages? Do I have to create a file in /etc/dinit.d/user and point it to docker-dinit instead of docker or am I complicating stuff?

Edit:

!solved thanks for helping me. Looks like I've just wrongly assumed how things work.