qymcad-bin
LOW
maintainer basson_xvi
0 votes
scanned 2026-09-08 05:16:12.985842
Why flagged
The package unpacks a published AppImage from the project's official GitHub release page; the source is verifiable and the build process is transparent, with no remote code execution or untrusted downloads beyond the AppImage itself, which is checksum-verified.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package unpacks a published AppImage from the project's official GitHub release page; the source is verifiable and the build process is transparent, with no remote code execution or untrusted downloads beyond the AppImage itself, which is checksum-verified.
PKGBUILD
1
# Maintainer: QymIsTech <basson30@gmail.com>
2
#
3
# QymCAD packaged from the published AppImage: the file is unpacked and its contents are laid out the way
4
# Arch expects them, rather than the AppImage being installed as a lump.
5
#
6
# WHY UNPACK RATHER THAN INSTALL THE .AppImage ITSELF. An AppImage placed in /opt and symlinked needs FUSE
7
# to mount itself at every start - one more moving part between a person and the program, and one that
8
# breaks on machines where FUSE is not set up. Unpacked, it is ordinary files: the desktop entry and the
9
# icons are where the desktop environment looks for them, and the program starts with no mount at all.
10
pkgname=qymcad-bin
11
# THE VERSION IS WRITTEN TWICE ON PURPOSE. `pkgver` may not contain a hyphen (pacman reads a hyphen as the
12
# boundary before pkgrel), while the release is named with one. `_relver` is the name the file really has
13
# on the release page; a guard keeps the two from drifting.
14
pkgver=0.1.0.dev.20260828
15
_relver=0.1.0-dev.20260828
16
pkgrel=1
17
pkgdesc="Parametric associative B-rep CAD/CAM"
18
arch=('x86_64')
19
url="https://github.com/QymIs-Tech/QymCAD"
20
license=('AGPL-3.0-or-later')
21
# WHAT THE PACKAGE DOES NOT CARRY. The AppImage brings its own copies of the window libraries, but the
22
# driver's side of the graphics stack must come from the system: a copy built elsewhere would talk to a
23
# driver it was not built against.
24
depends=('libglvnd' 'fontconfig' 'hicolor-icon-theme')
25
optdepends=('vulkan-icd-loader: hardware acceleration through Vulkan')
26
provides=('qymcad')
27
conflicts=('qymcad')
28
options=('!strip' '!debug')
29
source=("qymcad-${_relver}-${CARCH}.AppImage::${url}/releases/download/v${_relver}/qymcad-${_relver}-${CARCH}.AppImage")
30
noextract=("qymcad-${_relver}-${CARCH}.AppImage")
31
sha256sums=('c8609b56544940e22508a47263b87ab828a7ee807f9e626ed134679e57ddadab')
32
33
prepare() {
34
cd "$srcdir"
35
chmod +x "qymcad-${_relver}-${CARCH}.AppImage"
36
./"qymcad-${_relver}-${CARCH}.AppImage" --appimage-extract >/dev/null
37
}
38
39
package() {
40
cd "$srcdir/squashfs-root"
41
42
# The program and the libraries it carries, kept together under /opt so that nothing of ours lands
43
# among the system's own libraries.
44
install -d "$pkgdir/opt/qymcad"
45
cp -a usr "$pkgdir/opt/qymcad/"
46
47
# THE LINK GOES STRAIGHT TO THE BINARY. Measured on the built package: its RUNPATH is `$ORIGIN/../lib`,
48
# so it finds its own libraries relative to where it really lies, whatever path was used to reach it.
49
# The AppImage's `AppRun` is itself only a symlink to this same binary, so putting it in between would
50
# be a second hop that does nothing.
51
install -d "$pkgdir/usr/bin"
52
ln -s /opt/qymcad/usr/bin/qymcad "$pkgdir/usr/bin/qymcad"
53
54
# The desktop entry and the icons come OUT of the package rather than being written here again: a
55
# second copy of them would drift from the one the AppImage carries.
56
install -Dm644 qymcad.desktop "$pkgdir/usr/share/applications/qymcad.desktop"
57
for icon in usr/share/icons/hicolor/*/apps/qymcad.png; do
58
[ -e "$icon" ] || continue
59
install -Dm644 "$icon" "$pkgdir/usr/share/icons/hicolor/$(basename "$(dirname "$(dirname "$icon")")")/apps/qymcad.png"
60
done
61
62
# AGPL-3.0 asks for the licence text to accompany the program, and LGPL-2.1 (OCCT) for the notice.
63
install -Dm644 usr/share/doc/qymcad/LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
64
install -Dm644 usr/share/doc/qymcad/THIRD-PARTY-NOTICES.md "$pkgdir/usr/share/licenses/$pkgname/THIRD-PARTY-NOTICES.md"
65
66
# The copies under /opt would be installed twice over: once as the program, once as documentation.
67
rm -rf "$pkgdir/opt/qymcad/usr/share/doc"
68
}
69
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-08 05:16:12 | Low | 2 |