A bunch of AUR packages, like Yaourt itself, download their sources over HTTP and verify them with MD5, so even if you trust the AUR maintainer you have no idea if you&#x27;re getting the same file they did.<p>It&#x27;s sad that makepkg still uses MD5 by default in this day and age because &quot;it&#x27;s faster&quot;.