pinwin

LOW

maintainer slatkin 0 votes scanned 2026-10-18 17:22:42.773931

View on AUR

Why flagged

The package downloads a prebuilt binary from the project's official GitHub releases, which is a normal and trusted source for AUR packages; the low severity is due to the binary nature of the source and unverifiable checksum, but no malicious behavior is evident.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt binary from the project's official GitHub releases, which is a normal and trusted source for AUR packages; the low severity is due to the binary nature of the source and unverifiable checksum, but no malicious behavior is evident.

PKGBUILD

      1# Maintainer: slatkin@woims.net
    
      2pkgname=pinwin
    
      3pkgver=0.4.1
    
      4pkgrel=1
    
      5pkgdesc="Layer-shell app host: runs an app in a panel at one edge of a Wayland output"
    
      6arch=('x86_64')
    
      7url="https://github.com/slatkin/pinwin"
    
      8license=('GPL3')
    
      9depends=('fontconfig' 'libxkbcommon')
    
      10source=("${pkgname}-${pkgver}-linux-x86_64.tar.gz::https://github.com/slatkin/${pkgname}/releases/download/v${pkgver}/${pkgname}-${pkgver}-linux-x86_64.tar.gz")
    
      11sha256sums=('3f8c1b2bc2f0a8acdf060187d9ba0098e8fceab836be81811215c8837b7a30b5')
    
      12
    
      13package() {
    
      14    cd "${pkgname}-${pkgver}"
    
      15    install -Dm755 "pinwin" "${pkgdir}/usr/bin/pinwin"
    
      16    install -Dm644 "LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      17}
    
      18

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-18 17:22:42	Low	2