I agree with the general worry.
This is part of why maintainers matter.
Communities like Debian have built up a lot of trust that they are packaging software correctly, and their efforts matter a lot.
You should reject any sort of container or app "store" that isn't built upon trustworthy maintainers.
An AI probably could do it...unreliably.
The problem with most modern AI approaches is that they are fundamentally unreliable.
People are familiar with ChatGPT these days and its "hallucinations", where it invents things that aren't true out of thin air.
That's fundamental to large neural networks and not easily fixed.
So I wouldn't take that as a good way forward if the whole point is about trust.
But you could use some old-school AI techniques (expert systems) might do well.
I agree with the general worry. This is part of why maintainers matter. Communities like Debian have built up a lot of trust that they are packaging software correctly, and their efforts matter a lot. You should reject any sort of container or app "store" that isn't built upon trustworthy maintainers.
An AI probably could do it...unreliably. The problem with most modern AI approaches is that they are fundamentally unreliable. People are familiar with ChatGPT these days and its "hallucinations", where it invents things that aren't true out of thin air. That's fundamental to large neural networks and not easily fixed. So I wouldn't take that as a good way forward if the whole point is about trust.
But you could use some old-school AI techniques (expert systems) might do well.