Exactly. Let’s also not forget it isn’t just a matter of inspecting it once, it would be for EVERY update of the script. It would be a major bottleneck to get updates out for any package. There are comments on the AUR site where people can flag issues, so we do have some crowd sourcing, but I’d still not trust it.
Sorry if I was unclear. You usually don’t inspect the install scripts for official packages since you put the trust in the official team. You don’t trust(or at least shouldn’t) AUR packages, hence you should inspect the install script for those packages. I don’t really see what the alternative would be.
So what would the alternative be? If the resources or desire don’t exist to make a package official, how else would you install it?
What makes you think the contractor didn’t share the code? Or do you mean didn’t share the work to PC? Generally if it isn’t in the contract it may not have made sense for them to also make it for PC. It’s always quite a bit of work supporting 2 schemes.