(1) software i haven't heard of that pacman helpfully installed for me and claimed is a dependency of emacs
bonus! new pacman obfuscation tactic!
where you can depend upon a shared library from another package, so pacman -Qi fails unless you know their other fucked up command -Qo
(2) the software's about page is an about page of the user, who describes themself with:
I am a FOSS hacker with several interests.
so at this point i think ok yeah i am definitely OWNED owned owned now
[+2 desperation! your heart is pumping faster.]
(3) list of their software's documentation is an RSS feed
(4) their unindexed unnamespaced time-sorted list does not contain documentation for the software mentioned
and by this point they have said twice on their site off-color jokes like:
You would like to give me access to your system?
Use this public key.
(5) look at their list of softwares (also an rss feed)
(6) they have both pkg and pkg2 listed
so of course i have to assume my yubikeys are burned, rotating all my passwords, rotating my safewords, rotating my laptop, whispering "sorry my sweet child" to my laptop
(7) the pkg2 page says:
You know, pkg is a hack.
The idea of pkg2 is to be a nicer hack:
(8) the code for pkg is on github
(9) one of the contributors is in the top 3 of "most radioactively evil microsoft employee i have ever interacted with online" next to someone worse and lennart poettering