

it’s not managing, as you seem to imply, it’s just hosting.
Arch hosts the AUR repository, the maintenance of the packages is on the developers who developed the package.
If someone sneaks in spyware or malware inside the makepkg, that isn’t arch’s fault, that’s the maintainers fault of the makepkg.



“who may not be quite as stubborn as I am” that is the most Linus torvalds thing to say. good to see his passive agressive nature being put in a press release.