◎ AURWatch - AUR Security Monitor
scan coverage …
Last scan …
Next scan -

proton-cachyos-native-msgwaitall

maintainer MiguVT · 1 votes · scanned 2026-08-18 00:03:42.021799
LOW
View on AUR ↗
Why flagged The package builds Proton from CachyOS's official GitHub repo and substitutes the wine submodule with a maintainer-owned fork (wine-vapev4) via git, which is a legitimate customization pattern; all other sources are from official winehq/madewokherd infrastructure; the SKIP checksums on the two git sources are normal for git+https sources, and the overall build pattern is standard AUR Proton packaging with no obfuscated payloads or exfiltration.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The package builds Proton from CachyOS's official GitHub repo and substitutes the wine submodule with a maintainer-owned fork (wine-vapev4) via git, which is a legitimate customization pattern; all other sources are from official winehq/madewokherd infrastructure; the SKIP checksums on the two git sources are normal for git+https sources, and the overall build pattern is standard AUR Proton packaging with no obfuscated payloads or exfiltration.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:16 https://dl.winehq.org/wine/wine-gecko/${_geckover}/wine-gecko-${_geckover}-x86{,_64}.tar.xz

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: MiguVT
2
3pkgname=proton-cachyos-native-msgwaitall
4_srctag=11.0-20260703
5_commit=
6pkgver=${_srctag//-/.}
7_geckover=2.47.4
8_monover=11.2.0
9_xaliaver=0.4.9
10pkgrel=1
11epoch=1
12
13source=(
14 proton-cachyos::git+https://github.com/CachyOS/proton-cachyos.git#tag=cachyos-${_srctag}-native
15 wine-vapev4::git+https://github.com/MiguVT/wine-vapev4.git#branch=cachyos_11.0_MSGWAITALL
16 https://dl.winehq.org/wine/wine-gecko/${_geckover}/wine-gecko-${_geckover}-x86{,_64}.tar.xz
17 https://github.com/madewokherd/wine-mono/releases/download/wine-mono-${_monover}/wine-mono-${_monover}-x86.tar.xz
18 https://github.com/madewokherd/xalia/releases/download/xalia-${_xaliaver}/xalia-${_xaliaver}-net48-mono.zip
19 compatibilitytool.vdf.template
20 ntsync.conf
21)
22noextract=(
23 wine-gecko-${_geckover}-{x86,x86_64}.tar.xz
24 wine-mono-${_monover}-x86.tar.xz
25 xalia-${_xaliaver}-net48-mono.zip
26)
27
28pkgdesc="A compatibility tool for Steam Play based on Wine and additional components, experimental branch with extra CachyOS flavour (native msgwaitall build)"
29url="https://github.com/MiguVT/wine-vapev4/tree/cachyos_11.0_MSGWAITALL"
30arch=(x86_64 x86_64_v3)
31options=(!staticlibs !lto !debug emptydirs pestrip)
32license=('custom')
33depends=(
34 attr lib32-attr
35# blas lib32-blas
36 cabextract
37 desktop-file-utils
38 fontconfig lib32-fontconfig
39 flac lib32-flac
40 freetype2 lib32-freetype2
41 libgcc lib32-gcc-libs
42 gettext lib32-gettext
43 glib2 lib32-glib2
44 glibc lib32-glibc
45# lapack lib32-lapack
46 libgudev lib32-libgudev
47 libnsl lib32-libnsl
48 libpcap lib32-libpcap
49 libunwind lib32-libunwind
50 libvpx lib32-libvpx
51 libwebp lib32-libwebp
52 libx11 lib32-libx11
53 libxcursor lib32-libxcursor
54 libxext lib32-libxext
55 libxkbcommon lib32-libxkbcommon
56 libxml2 lib32-libxml2
57 libxi lib32-libxi
58 libxrandr lib32-libxrandr
59 mpg123 lib32-mpg123
60 pipewire lib32-pipewire
61 python
62 python-six
63 speex lib32-speex
64 speexdsp lib32-speexdsp
65# Start of old steam-native-runtime
66 atk lib32-atk
67 cairo lib32-cairo
68 curl lib32-curl
69 dbus-glib lib32-dbus-glib
70 freeglut lib32-freeglut
71 gdk-pixbuf2 lib32-gdk-pixbuf2
72 glu lib32-glu
73 lcms2 lib32-lcms2
74 libcaca lib32-libcaca
75 libcanberra lib32-libcanberra
76 dbus lib32-dbus
77 libdrm lib32-libdrm
78 libice lib32-libice
79 libibus
80 libnm lib32-libnm
81 libusb lib32-libusb
82 libvdpau lib32-libvdpau
83 libvorbis lib32-libvorbis
84 libxft lib32-libxft
85 libxmu lib32-libxmu
86 libxrender lib32-libxrender
87 libxtst lib32-libxtst
88 nspr lib32-nspr
89 openal lib32-openal
90 pango lib32-pango
91 sdl2-compat lib32-sdl2-compat
92 pipewire lib32-pipewire
93 librsvg
94 libsm lib32-libsm
95 libtheora lib32-libtheora
96 vulkan-driver lib32-vulkan-driver
97# End of old steam-native-runtime
98 unzip
99 wayland lib32-wayland
100 xz lib32-xz
101)
102makedepends=(
103 afdko
104 alsa-lib lib32-alsa-lib
105 clang
106 cmake
107 ffmpeg
108 fontforge
109 giflib lib32-giflib
110 git
111 glib2-devel
112 glslang
113 gnutls lib32-gnutls
114 gtk3 lib32-gtk3
115 libgphoto2
116 libpulse lib32-libpulse
117 libva lib32-libva
118 libxcomposite lib32-libxcomposite
119 libxinerama lib32-libxinerama
120 libxxf86vm lib32-libxxf86vm
121 lld
122 mesa lib32-mesa
123 mesa-libgl lib32-mesa-libgl
124 meson
125 mingw-w64-gcc
126 mingw-w64-tools
127 nasm
128 opencl-headers
129 opencl-icd-loader lib32-opencl-icd-loader
130 pcsclite lib32-pcsclite
131 perl
132 perl-json
133 rsync
134 rust lib32-rust-libs
135 python-pefile
136 python-setuptools-scm
137 samba
138 unixodbc
139 v4l-utils lib32-v4l-utils
140 vulkan-headers
141 vulkan-icd-loader lib32-vulkan-icd-loader
142 wayland-protocols
143 wget
144 xorg-util-macros
145)
146optdepends=(
147 alsa-lib lib32-alsa-lib
148 alsa-plugins lib32-alsa-plugins
149 ffmpeg
150 gnutls lib32-gnutls
151 gtk3 lib32-gtk3
152 libgphoto2
153 libpulse lib32-libpulse
154 libva lib32-libva
155 libxcomposite lib32-libxcomposite
156 libxinerama lib32-libxinerama
157 opencl-icd-loader lib32-opencl-icd-loader
158 pcsclite lib32-pcsclite
159 samba
160 steam
161 umu-launcher
162 unixodbc
163 v4l-utils lib32-v4l-utils
164 vulkan-icd-loader lib32-vulkan-icd-loader
165)
166optdepends+=(
167 NTSYNC-MODULE
168)
169provides=('proton-cachyos-native' 'proton-cachyos' 'proton')
170replaces=('proton-cachyos-native' 'proton-cachyos')
171backup=(
172 "usr/share/steam/compatibilitytools.d/${pkgname}/user_settings.py"
173)
174install=${pkgname}.install
175
176_make_wrappers () {
177 # _arch prefix gcc ld as strip
178 local _i686=( "i686" "-m32" "-melf_i386" "--32" "elf32-i386")
179 local _x86_64=("x86_64" "-m64" "-melf_x86_64" "--64" "elf64-x86-64")
180 local _opts=(_i686 _x86_64)
181 declare -n _opt
182 for _opt in "${_opts[@]}"; do
183 for l in ar ranlib nm; do
184 ln -s /usr/bin/gcc-$l wrappers/${_opt[0]}-pc-linux-gnu-$l
185 done
186 for t in gcc g++; do
187 install -Dm755 /dev/stdin wrappers/${_opt[0]}-pc-linux-gnu-$t <<EOF
188#!/usr/bin/bash
189$(which ccache 2> /dev/null) /usr/bin/$t ${_opt[1]} "\$@"
190EOF
191 done
192 install -Dm755 /dev/stdin wrappers/${_opt[0]}-pc-linux-gnu-ld <<EOF
193#!/usr/bin/bash
194/usr/bin/ld ${_opt[2]} "\$@"
195EOF
196 install -Dm755 /dev/stdin wrappers/${_opt[0]}-pc-linux-gnu-as <<EOF
197#!/usr/bin/bash
198/usr/bin/as ${_opt[3]} "\$@"
199EOF
200 install -Dm755 /dev/stdin wrappers/${_opt[0]}-pc-linux-gnu-strip <<EOF
201#!/usr/bin/bash
202/usr/bin/strip -F ${_opt[4]} "\$@"
203EOF
204 done
205}
206
207prepare() {
208 # Provide wrappers to compiler tools
209 rm -rf wrappers && mkdir wrappers
210 _make_wrappers
211
212 [ ! -d build ] && mkdir build
213
214 cd proton-cachyos
215
216 [ ! -d contrib ] && mkdir -p contrib
217 mv "$srcdir"/wine-gecko-${_geckover}-x86{,_64}.tar.xz contrib/
218 mv "$srcdir"/wine-mono-${_monover}-x86.tar.xz contrib/
219 mv "$srcdir"/xalia-${_xaliaver}-net48-mono.zip contrib/
220
221 _submodules=(
222 OpenXR-SDK
223 SPIRV-Headers
224 Vulkan-Headers
225 dav1d
226 dxvk
227 dxvk-nvapi
228 extras/d7vk
229 extras/discord-rpc-bridge
230 extras/dxvk-low-latency
231 extras/vkd3d-low-latency
232 extras/dxvk-sarek
233 ffmpeg
234 fonts/liberation-fonts
235 glslang
236 graphene
237 gst-orc
238 gst-plugins-rs
239 gstreamer
240 libsoup
241 meson
242 nvidia-libs/dxvk-nvapi
243 nvidia-libs/nvcuda
244 nvidia-libs/nvcuda32
245 nvidia-libs/nvenc
246 nvidia-libs/nvenc32
247 nvidia-libs/wine-nvml
248 nvidia-libs/wine-nvoptix
249 openvr
250 protonfixes
251 vkd3d
252 vkd3d-proton
253 vklayers/Vulkan-Utility-Libraries
254 vklayers/low_latency_layer
255 vklayers/pyroveil
256 vklayers/vkbasalt
257 )
258
259 # Explicitly set origin URL for submodules using relative paths
260 git remote set-url origin https://github.com/CachyOS/proton-cachyos.git
261 git submodule update --init --filter=tree:0 --recursive "${_submodules[@]}"
262
263 # Replace wine submodule with our custom MSGWAITALL repository
264 rm -rf wine
265 cp -a "$srcdir/wine-vapev4" wine
266
267 for rustlib in gst-plugins-rs; do
268 pushd $rustlib
269 export RUSTUP_TOOLCHAIN=stable
270 export CARGO_HOME="${SRCDEST}"/proton-cargo
271 export CARGO_NET_GIT_FETCH_WITH_CLI=true
272 cargo fetch --locked --target i686-unknown-linux-gnu
273 cargo fetch --locked --target x86_64-unknown-linux-gnu
274 popd
275 done
276}
277
278build() {
279 export PATH="$(pwd)/wrappers:$PATH"
280
281 local -a split=($CFLAGS)
282 local -A flags
283 for opt in "${split[@]}"; do flags["${opt%%=*}"]="${opt##*=}"; done
284 local march="${flags["-march"]:-nocona}"
285 local mtune="${flags["-mtune"]:-core-avx2}"
286
287 CFLAGS="-O2 -march=${march} -mtune=${mtune}"
288 CXXFLAGS="-O2 -march=${march} -mtune=${mtune}"
289 RUSTFLAGS="-C opt-level=3 -C target-cpu=${march}"
290 LDFLAGS="-Wl,-O1,--sort-common,--as-needed"
291
292 export CFLAGS CXXFLAGS RUSTFLAGS LDFLAGS
293
294 export RUSTUP_TOOLCHAIN=stable
295 export CARGO_HOME="${SRCDEST}"/proton-cargo
296
297 cd build
298 ROOTLESS_CONTAINER="" \
299 ../proton-cachyos/configure.sh \
300 --container-engine="none" \
301 --proton-sdk-image="" \
302 --build-name="${pkgname}" \
303 --without-steamrt-depends \
304 --without-tts
305
306 SUBJOBS=$([[ "$MAKEFLAGS" =~ -j\ *([1-9][0-9]*) ]] && echo "${BASH_REMATCH[1]}" || echo "$(nproc)") \
307 make -j1 dist
308
309 cd dist
310 sed -r \
311 -e "s|##INSTALL_PATH##|.|" \
312 -e "s|##DISPLAY_NAME##|proton-cachyos-${_srctag} (native-msgwaitall)|" \
313 -e "s|##INTERNAL_TOOL_NAME##|${pkgname}|" \
314 "${srcdir}/compatibilitytool.vdf.template" > compatibilitytool.vdf
315}
316
317package() {
318 cd build
319
320 # Delete the intermediate build directories to free space (mostly for my github actions)
321 rm -rf dst-* obj-* src-* pfx-*
322
323 local _compatdir="${pkgdir}/usr/share/steam/compatibilitytools.d"
324 mkdir -p "${_compatdir}/${pkgname}"
325 rsync --delete -arx dist/* "${_compatdir}/${pkgname}"
326
327 mkdir -p "${pkgdir}/usr/share/licenses/${pkgname}"
328 mv "${_compatdir}/${pkgname}"/{PATENTS.AV1,LICENSE{,.OFL}} \
329 "${pkgdir}/usr/share/licenses/${pkgname}"
330
331 # Load ntsync module
332 install -Dm644 "$srcdir/ntsync.conf" "$pkgdir/usr/lib/modules-load.d/10-$pkgname.conf"
333
334 cd "${_compatdir}/${pkgname}/files"
335
336 local _geckodir="share/wine/gecko/wine-gecko-${_geckover}"
337 i686-w64-mingw32-strip --strip-debug \
338 $(find "${_geckodir}"-x86 -iname "*.dll" -or -iname "*.exe")
339 x86_64-w64-mingw32-strip --strip-debug \
340 $(find "${_geckodir}"-x86_64 -iname "*.dll" -or -iname "*.exe")
341
342 local _monodir="share/wine/mono/wine-mono-${_monover}"
343 i686-w64-mingw32-strip --strip-debug \
344 $(find "${_monodir}"/lib/mono -iname "*.dll" -or -iname "*.exe")
345 i686-w64-mingw32-strip --strip-debug \
346 "${_monodir}"/lib/x86/*.dll \
347 $(find "${_monodir}" -iname "*x86.dll" -or -iname "*x86.exe")
348 x86_64-w64-mingw32-strip --strip-debug \
349 "${_monodir}"/lib/x86_64/*.dll \
350 $(find "${_monodir}" -iname "*x86_64.dll" -or -iname "*x86_64.exe")
351}
352
353b2sums=('SKIP'
354 'SKIP'
355 '2a73c12585b502ae11188482cbc9fb1f45f95bfe4383a7615011104b132f4845f9813d01fb40277e1934fab5f1b35ab40b4f4a66a9967463dd1d666a666904e9'
356 '62856a88266b4757602c0646e024f832974a93f03b9df253fd4895d4f11a41b435840ad8f7003ec85a0d8087dec15f2e096dbfb4b01ebe4d365521e48fd0c5c0'
357 '74555b5f02cb8053ccfb272c30f88e00bb647291ebf57ebd1bce067275ea9184fc0a983d26f4014fa1d6fae53ada9258ddaf11938f0b821fab1bde58257399b1'
358 '5a492e5bd62a8116c2571348f01e1ea9dd70e2a185f0891a27be4091c8f182ce55e48f075fe46badf80e0f5b831a1d5993b2b6e1f130f4d6b00e3ef77254d00d'
359 'f0a81d83e644ca074a6bf54fc74ae12f5bd047e29d87fab528fba20e4b8d013547ad4b26e912c2b3218a75114f5c76b64aa84fdbc3054d3a1d9bf96635c6212b'
360 '964a3ba277821e570aec2127f0d1ae9898da6976c360deb6b196345a50bd3c2c55cb399527507006d8fddef868069032a30b083f23987d5050f185c74dd9de35')

Scan history

Scanned at (UTC)SeverityRules
2026-08-18 00:03:42 LOW 3
2026-08-17 00:18:29 LOW 3
2026-08-16 00:03:42 LOW 3
2026-08-15 00:26:13 LOW 3
2026-08-14 00:03:41 LOW 3
2026-08-13 15:32:42 LOW 3
2026-08-13 15:26:23 MEDIUM 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion