Interesting, if I understand correctly it seems like Anubis is just being used in a use case inappropriate way here?
The Arch equivalent to this would be building AUR packages from source, which seems to universally work fine without any of these issues.
Are NixOS repos putting their source behind Anubis or something? I’m tempted to start on an “I don’t like NixOS” rant but I don’t know who owns these forges.
then some process takes those PKGBUILDs, downloads the sources from the upstream URLs, and builds them into the binary packages that end up in the official pacman repositories.
The same process happens on NixOS to build their official repository (which is called the "Nix Binary Cache"). So most NixOS users, when installing software, they are just downloading prebuilt binary packages from official NixOS servers just like pacman does on Arch. I, however, disable the Nix's official package repository so when I install software it is like building from a PKGBUILD: it needs to download the sources from the upstream URL and build the package.
I'd imagine the reason I run into this issue a lot more than you do is usually you only install a couple of packages from the AUR. The vast majority of your packages are going to come prebuilt from official Arch repositories. Whereas on my systems, 100% of the software is being built from source. So if any of my software is developed on a site using anubis to protect their source tarballs or patch files, I will hit this issue.
I imagine that when I install AUR packages that are building from source, the community AUR maintainers have already figured out these issues if they exist, while you are left as the person figuring them out for every single package since you’re building from source.
Maybe the problem here is that people are using Anubis without understanding what its purpose is. If you are publishing open source code in a forge you should want and encourage bots and other automated systems to download your code.
The Arch equivalent to this would be building AUR packages from source, which seems to universally work fine without any of these issues.
Are NixOS repos putting their source behind Anubis or something? I’m tempted to start on an “I don’t like NixOS” rant but I don’t know who owns these forges.