> But it could just as easily be malware
Everything that can be downloaded could easily be malware. No users verify binaries/compile from line-by-line verified source.
It's always about trust in author and distributor. Curl | bash or AUR or build from source - matters very little.
There’s a big difference between executing something from your package manager—and bluez is packaged by literally every major distribution—and executing:
a random binary from a brand new GitHub repo (which you didn’t build and can be swapped out for something evil any time)
…that’s actually a different project’s binary rebuilt and renamed/redistributed (or malware)
…as root
…on a hypervisor.
So yes,
> It's always about trust in author and distributor
Is totally correct. There are different levels of trust. This repo merits very low trust.