Most libraries build with cmake, make etc, how does this interact?

C++ doesn't have one true package manager which means all third party dependencies will use totally different build systems and you can never have an easy `cargo add ...`. The closest I know of is vcpkg which has a decent selection but even then it's missing lots and still really clunky to set up.

I also worry about unpopular software repositories like that - it would be very easy to take some popular software that isn't packaged there, add it, bide your time and then poke some malware in. You don't even need to gain the original maintainers' trust.

The same applies to things like Flathub. I'm really surprised it hasn't happened yet (as far as I know).