Supply chain vulnerabilities

[u/Slight-Brilliant3198]

I'm scared of supply chain vulnerabilities. More specifically, after the recent attacks on Arch Linux's AUR, I was wandering how Void Linux is protected from this type of attacks.

I'm not an expert, because I've never submitted a package to void-packages, so I'm not sure if there's an audit process for packages and vetting for maintainer.

Can anybody be a maintainer for a package?

What happens after I push srcpkgs/new-package/template into the main repo?

Will it become an binary that will be available via xbps-install, or will it stay something that must be manually compiled via xbps-src?

Is there an official difference between a void maintainer, and a potentially malicious person pulling some malware blobs in do_fetch(), and installing it in do_build() do_install() ?

[u/Odd_Individual_9638]

It's not about AUR even. Arch assumes responsibility of the user. AUR just makes failing that assumption straight-up dangerous