flamewm-bin
LOW
maintainer lapsus
0 votes
scanned 2026-10-28 01:49:03.400007
Why flagged
The package installs prebuilt binaries from GitHub releases, which is a common AUR practice; the binaries are from the project's official repository, reducing supply-chain risk, and no obfuscated or malicious behavior is evident.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs prebuilt binaries from GitHub releases, which is a common AUR practice; the binaries are from the project's official repository, reducing supply-chain risk, and no obfuscated or malicious behavior is evident.
PKGBUILD
1
# Maintainer: Yakov Till <yakov.till@gmail.com>
2
# Contributor: ArkFlame Studios <maintainers@arkflame.dev>
3
4
pkgname=flamewm-bin
5
pkgver=0.1.2b
6
pkgrel=1
7
pkgdesc='Fast Rust X11 window manager and desktop session, with a preliminary Wayland compositor'
8
arch=('x86_64')
9
url='https://wm.arkflame.com'
10
license=('LGPL-2.0-only' 'MIT' 'LGPL-3.0-or-later' 'GPL-3.0-only')
11
# bash and python run the session wrappers and the desktop-services companion.
12
# pam is loaded at runtime by the lock screen, not at link time. mesa provides
13
# libgbm, systemd-libs provides libudev, dbus provides libdbus-1.
14
# The X11 renderer and the Wayland compositor resolve Xft, fontconfig, Xrender,
15
# Xext, Xcursor, Xcomposite, Xdamage, XCB, EGL, GLES and libwayland through
16
# dlopen, so they never appear as NEEDED entries and are declared here.
17
# Upstream implements its own systemd-logind seat session, so neither libseat
18
# nor seatd is required; both upstream's Arch and Debian metadata confirm it.
19
depends=(
20
'bash'
21
'dbus'
22
'fontconfig'
23
# The .deb is built against a glibc newer than any Arch snapshot; the binaries
24
# require GLIBC_2.43 and fail to start against an older one.
25
'glibc>=2.43'
26
'libdrm'
27
'libgcc'
28
'libglvnd'
29
'libinput'
30
'libpulse'
31
'libx11'
32
'libxcb'
33
'libxcomposite'
34
'libxcursor'
35
'libxdamage'
36
'libxext'
37
'libxft'
38
'libxi'
39
'libxkbcommon'
40
'libxrender'
41
'mesa'
42
'pam'
43
'python'
44
'systemd-libs'
45
'wayland'
46
'xorg-xwayland'
47
)
48
optdepends=(
49
'ark: archive extraction from Explorer'
50
'dex: XDG autostart entries'
51
'dunst: notification daemon for the session'
52
'ffmpeg: screen recording'
53
'imagemagick: desktop Convert wheel'
54
'kwallet-pam: unlock KWallet at login'
55
'libnotify: Explorer notifications'
56
'libxkbcommon-x11: nested compositor session inside X11'
57
'polkit-kde-agent: authentication agent for privileged actions'
58
'ttf-ibm-plex: default interface font (falls back to Noto Sans or DejaVu Sans)'
59
'udisks2: mount removable drives from Explorer'
60
'xdg-desktop-portal-gtk: fallback portal backend'
61
'xdg-desktop-portal-kde: preferred OpenURI and FileChooser portal backend'
62
'xdg-utils: open files and links with their default applications'
63
'xorg-xprop: deferred XDG autostart after the window manager is ready'
64
'xorg-xrandr: display layout settings and restore at login'
65
)
66
provides=('flamewm')
67
# The bundled McMojave cursor theme owns /usr/share/icons/McMojave-cursors,
68
# which the AUR packages of the same theme also install.
69
conflicts=('flamewm' 'flamewm-git' 'mcmojave-cursors' 'mcmojave-cursors-git')
70
# Prebuilt release binaries: upstream strips their symbols, so a -debug package
71
# would carry no information.
72
options=('!debug')
73
backup=('etc/pam.d/flamewm-lock' 'etc/xdg/menus/flamewm-applications.menu')
74
75
latestver() {
76
gh api repos/ArkFlame/flamewm/releases/latest --jq '.tag_name'
77
}
78
79
# The release tag carries a revision letter that the .deb filename does not:
80
# tag 0.1.2b publishes flamewm_0.1.2_amd64.deb. pkgver keeps the tag, because
81
# consecutive revisions are separately built and are byte-different payloads
82
# under the same .deb filename.
83
_debver=${pkgver%[a-z]}
84
85
source=(
86
"flamewm-${pkgver}-amd64.deb::https://github.com/ArkFlame/flamewm/releases/download/${pkgver}/flamewm_${_debver}_amd64.deb"
87
"flamewm-lock.pam::https://raw.githubusercontent.com/ArkFlame/flamewm/${pkgver}/packaging/arch/flamewm-lock.pam"
88
)
89
sha256sums=('c436546d075421f3ac2cf741aaf6367905f4a8c1c53ecf12ff81039b86053bf0'
90
'2f9b7a7a8a8583ed40969240ee7d0d42ffba4a44b69a7d241bd60634795a8e84')
91
92
package() {
93
bsdtar -xf "${srcdir}/flamewm-${pkgver}-amd64.deb" data.tar.zst
94
bsdtar -xf data.tar.zst -C "${pkgdir}"
95
96
# The .deb stores directories 0775 and data files 0664; Arch expects 0755 and
97
# 0644, and pacman -Qkk reports every group-writable directory as altered.
98
find "${pkgdir}" -type d -exec chmod 755 {} +
99
find "${pkgdir}" -type f -perm -u+x -exec chmod 755 {} +
100
find "${pkgdir}" -type f ! -perm -u+x -exec chmod 644 {} +
101
102
# Arch has no /usr/libexec, and neither the binaries nor the wrappers name it
103
# (the wrappers resolve their own directory from BASH_SOURCE), so only the two
104
# session entries that exec them have to follow the move.
105
install -d "${pkgdir}/usr/lib/flamewm"
106
mv "${pkgdir}/usr/libexec/flamewm/"* "${pkgdir}/usr/lib/flamewm/"
107
rmdir "${pkgdir}/usr/libexec/flamewm" "${pkgdir}/usr/libexec"
108
sed -i 's|/usr/libexec/flamewm/|/usr/lib/flamewm/|' \
109
"${pkgdir}/usr/share/xsessions/flamewm.desktop" \
110
"${pkgdir}/usr/share/wayland-sessions/flamewm-wayland.desktop"
111
112
# The .deb ships the Debian PAM include layout. Arch has no common-auth, so
113
# the service must include system-auth or the lock screen cannot authenticate.
114
install -Dm644 "${srcdir}/flamewm-lock.pam" "${pkgdir}/etc/pam.d/flamewm-lock"
115
116
# Only the MIT component needs its text shipped; LGPL-2.0-only, LGPL-3.0-or-later
117
# and GPL-3.0-only are provided by the licenses package. The remaining files
118
# carry attribution for the bundled Breeze icons, cursors and the MIT renderer.
119
local _l="${pkgdir}/usr/share/licenses/${pkgname}"
120
install -Dm644 "${pkgdir}/usr/share/doc/flamewm/LICENSES/RustWebRender-MIT.txt" \
121
"${_l}/RustWebRender-MIT.txt"
122
install -Dm644 "${pkgdir}/usr/share/flamewm/assets/cursors/COPYING-ICONS" \
123
"${_l}/COPYING-ICONS-cursors"
124
install -Dm644 "${pkgdir}/usr/share/flamewm/assets/cursors/AUTHORS" \
125
"${_l}/AUTHORS-cursors"
126
install -Dm644 "${pkgdir}/usr/share/flamewm/assets/web/breeze/COPYING-ICONS" \
127
"${_l}/COPYING-ICONS-breeze"
128
install -Dm644 "${pkgdir}/usr/share/doc/flamewm/copyright" "${_l}/copyright"
129
130
local _binary
131
for _binary in flamewm flamewm-apps flamewm-session flamewm-desktop flamewm-shell \
132
flamewm-settings flamewm-explorer flamewm-terminal flamewm-screenshot \
133
flamewm-lock flamewm-wayland flamewm-render-x11 flamewm-render-compile \
134
flamewm-render-inspect; do
135
[[ -x "${pkgdir}/usr/bin/${_binary}" ]] || {
136
echo "flamewm-bin: /usr/bin/${_binary} is missing from the upstream payload" >&2
137
return 1
138
}
139
done
140
[[ -d "${pkgdir}/usr/libexec" ]] && {
141
echo 'flamewm-bin: payload still installs into /usr/libexec' >&2
142
return 1
143
}
144
grep -qx 'auth include system-auth' "${pkgdir}/etc/pam.d/flamewm-lock" || {
145
echo 'flamewm-bin: PAM service is not the system-auth layout' >&2
146
return 1
147
}
148
}
149
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-28 01:49:03 | Low | 2 |