picoforge-bin

LOW

maintainer Goldbro233 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package installs a prebuilt AppImage from the project's official GitHub releases, which is normal for AUR packages; the source is trustworthy and no malicious behavior is present.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt AppImage from the project's official GitHub releases, which is normal for AUR packages; the source is trustworthy and no malicious behavior is present.

PKGBUILD

      1# Maintainer: Goldbro233 <bowensun_06@outlook.com>
    
      2# SPDX-License-Identifier: 0BSD
    
      3
    
      4pkgname=picoforge-bin
    
      5pkgver=0.9.0
    
      6pkgrel=3
    
      7pkgdesc='Desktop tool for configuring and managing Pico FIDO security keys (prebuilt binary)'
    
      8arch=('x86_64')
    
      9url='https://github.com/librekeys/picoforge'
    
      10# The SPDX header and local LICENSE cover packaging; this is the upstream app license.
    
      11license=('AGPL-3.0-only')
    
      12# Namcap cannot see these runtime requirements from the main ELF's DT_NEEDED:
    
      13# ccid supplies the PC/SC driver, while Wayland and Vulkan are loaded with dlopen().
    
      14# Keep these dependencies so PC/SC access and the supported GUI backends work by default.
    
      15depends=('glibc' 'libgcc' 'pcsclite' 'ccid' 'libxcb' 'libxkbcommon' 'libxkbcommon-x11'
    
      16         'util-linux-libs' 'wayland' 'vulkan-icd-loader' 'hicolor-icon-theme')
    
      17makedepends=('7zip')
    
      18optdepends=('vulkan-driver: Vulkan renderer for the graphical interface')
    
      19provides=("picoforge=$pkgver")
    
      20conflicts=('picoforge' 'picoforge-git')
    
      21options=('!strip' '!debug')
    
      22install=picoforge-bin.install
    
      23
    
      24_appimage="picoforge_${pkgver}_glibc-2.28_x86-64.AppImage"
    
      25source=("$_appimage::$url/releases/download/v$pkgver/$_appimage"
    
      26        "picoforge-LICENSE::https://raw.githubusercontent.com/librekeys/picoforge/v$pkgver/LICENSE")
    
      27noextract=("$_appimage")
    
      28sha256sums=('81c12f129cf0e55bc932f94db9781204a25ab919d94e985ed16027014f66bff5'
    
      29            'd8a6cc31abc16b6748c7a21f21611f5a1ec33f67d22ca23d7da1c19b95496bee')
    
      30
    
      31prepare() {
    
      32    # Extract once during packaging; installed programs do not need FUSE.
    
      33    7z x -y -oAppDir "$_appimage"
    
      34    # The AppImage's old libxkbcommon cannot parse newer system Compose keysyms
    
      35    # such as dead_hamza. Use Arch's keyboard libraries alongside its Compose data.
    
      36    # Remove both bundled libraries to avoid mixing versions; the dynamic loader
    
      37    # falls back to the system libraries when they are absent from $ORIGIN/../lib.
    
      38    rm -f AppDir/usr/lib/libxkbcommon.so* AppDir/usr/lib/libxkbcommon-x11.so*
    
      39}
    
      40
    
      41package() {
    
      42    # Arch permits large self-contained applications under /opt/<pkgname>.
    
      43    # Namcap flags ELF files below /opt, but this package preserves the upstream
    
      44    # AppImage's relative $ORIGIN/../lib layout for its private libraries.
    
      45    # Keep the remaining upstream libraries: Namcap checks each ELF from /tmp,
    
      46    # losing this relative layout. Unused-link warnings, including glibc
    
      47    # compatibility libraries, alone do not prove a bundled file can be removed.
    
      48    install -dm755 "$pkgdir/opt/picoforge/usr"
    
      49    cp -a AppDir/usr/bin AppDir/usr/lib "$pkgdir/opt/picoforge/usr/"
    
      50    install -dm755 "$pkgdir/usr/bin"
    
      51    ln -s /opt/picoforge/usr/bin/picoforge "$pkgdir/usr/bin/picoforge"
    
      52
    
      53    install -Dm644 AppDir/usr/share/applications/in.suyogtandel.picoforge.desktop \
    
      54        "$pkgdir/usr/share/applications/in.suyogtandel.picoforge.desktop"
    
      55    install -Dm644 AppDir/usr/share/icons/hicolor/scalable/apps/in.suyogtandel.picoforge.svg \
    
      56        "$pkgdir/usr/share/icons/hicolor/scalable/apps/in.suyogtandel.picoforge.svg"
    
      57    install -Dm644 AppDir/usr/share/metainfo/in.suyogtandel.picoforge.metainfo.xml \
    
      58        "$pkgdir/usr/share/metainfo/in.suyogtandel.picoforge.metainfo.xml"
    
      59    install -Dm644 picoforge-LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      60}
    
      61

Changes since previous scan

--- PKGBUILD @ 2026-10-14 00:06
+++ PKGBUILD @ 2026-10-17 00:21
@@ -1,15 +1,19 @@
 # Maintainer: Goldbro233 <bowensun_06@outlook.com>
+# SPDX-License-Identifier: 0BSD
 
 pkgname=picoforge-bin
 pkgver=0.9.0
-pkgrel=1
+pkgrel=3
 pkgdesc='Desktop tool for configuring and managing Pico FIDO security keys (prebuilt binary)'
 arch=('x86_64')
 url='https://github.com/librekeys/picoforge'
+# The SPDX header and local LICENSE cover packaging; this is the upstream app license.
 license=('AGPL-3.0-only')
-# PC/SC and GPUI's dynamically loaded Wayland/Vulkan backends use host libraries.
-depends=('glibc' 'libgcc' 'pcsclite' 'ccid' 'libxcb' 'util-linux-libs'
-         'wayland' 'vulkan-icd-loader' 'hicolor-icon-theme')
+# Namcap cannot see these runtime requirements from the main ELF's DT_NEEDED:
+# ccid supplies the PC/SC driver, while Wayland and Vulkan are loaded with dlopen().
+# Keep these dependencies so PC/SC access and the supported GUI backends work by default.
+depends=('glibc' 'libgcc' 'pcsclite' 'ccid' 'libxcb' 'libxkbcommon' 'libxkbcommon-x11'
+         'util-linux-libs' 'wayland' 'vulkan-icd-loader' 'hicolor-icon-theme')
 makedepends=('7zip')
 optdepends=('vulkan-driver: Vulkan renderer for the graphical interface')
 provides=("picoforge=$pkgver")
@@ -27,10 +31,20 @@
 prepare() {
     # Extract once during packaging; installed programs do not need FUSE.
     7z x -y -oAppDir "$_appimage"
+    # The AppImage's old libxkbcommon cannot parse newer system Compose keysyms
+    # such as dead_hamza. Use Arch's keyboard libraries alongside its Compose data.
+    # Remove both bundled libraries to avoid mixing versions; the dynamic loader
+    # falls back to the system libraries when they are absent from $ORIGIN/../lib.
+    rm -f AppDir/usr/lib/libxkbcommon.so* AppDir/usr/lib/libxkbcommon-x11.so*
 }
 
 package() {
-    # Preserve $ORIGIN/../lib so the upstream binary finds its bundled libraries.
+    # Arch permits large self-contained applications under /opt/<pkgname>.
+    # Namcap flags ELF files below /opt, but this package preserves the upstream
+    # AppImage's relative $ORIGIN/../lib layout for its private libraries.
+    # Keep the remaining upstream libraries: Namcap checks each ELF from /tmp,
+    # losing this relative layout. Unused-link warnings, including glibc
+    # compatibility libraries, alone do not prove a bundled file can be removed.
     install -dm755 "$pkgdir/opt/picoforge/usr"
     cp -a AppDir/usr/bin AppDir/usr/lib "$pkgdir/opt/picoforge/usr/"
     install -dm755 "$pkgdir/usr/bin"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 01:18:27	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 17:17:20	Low	2
2026-10-13 15:17:00	Low	2