How does Parabola keep up with Arch?
Given that Arch is rolling, how quickly does Parabola "keep up" with these updates? I'm assuming Parabola must also be rolling as well.
Also, correct me if I'm wrong: my understanding is that Parabola only allows Free Software via Pacman, meaning that a user couldn't accidentally install any proprietary software this way. But with the AUR, we would still have to be judicious, correct? Any other possible vulnerabilities through which proprietary software could enter my machine?
currently, parabola repos are between 1-24 hours behind arch, then each mirror adds an arbitrary delay of another 1-24 hours; though there is a plan to decrease the total delay to closer to 1-2 hours - the actual time will inevitibly depend on the cooperation of the mirrors
parabola users can not install any proprietary software from the AUR accidentally either - parabola has no user friendly AUR tools - so, in order to install anything from AUR, one must download the PKGBUILD and run makepkg, both manually and intentionally - the tools to be wary of are other third-prty package managers, such as pip, rubygem, npm, docker, and similar - there is an on-going discussion for ways to improve those too