scx-manager-bin
LOW
maintainer MadGoat
1 votes
scanned 2026-09-11 01:21:31.837469
Why flagged
The package installs a prebuilt binary from the project's official GitHub Releases with a verified checksum, posing no active threat; the risk is limited to trusting the upstream build process, which is typical for -bin packages.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from the project's official GitHub Releases with a verified checksum, posing no active threat; the risk is limited to trusting the upstream build process, which is typical for -bin packages.
PKGBUILD
1
# Maintainer: MadGoat <ghazlett@gmail.com>
2
#
3
# PREBUILT-BINARY companion to the source package `scx-manager`
4
# (the source PKGBUILD is RETAINED — this is an addition, not a
5
# replacement). Installs a precompiled x86_64 Release build produced
6
# by the release-bin workflow (.github/workflows/release-bin.yml):
7
# archlinux:base-devel container, GCC + GNU ld + Unix Makefiles,
8
# Release + -ffat-lto-objects — byte-parity with the documented AUR
9
# source build (packaging/scx-manager/PKGBUILD:28-37). No build step,
10
# no makedepends, no CPM/cargo network fetches in the user's chroot.
11
#
12
# DEPENDENCY AUTHORITY: names mirror the source PKGBUILD's depends=
13
# (qt6-base polkit scx-tools). The >= floors below are the build
14
# environment's actuals from the first release-bin run's audit
15
# section (run 34546612569, 2026-09-11: qt6-base 6.11.2-3, polkit
16
# 127-3, scx-tools 1.1.3-1) — re-captured from each release's audit
17
# (the standing per-release re-capture, plans/PLAN.md §7).
18
#
19
# FILE COLLISION CONTRACT: this package installs the SAME file set as
20
# `scx-manager` and `scx-manager-git` (usr/bin/scx-manager,
21
# libscxctl-ui.so.1*, headers + cmake config, desktop file, icon,
22
# LICENSE). Mutual `conflicts=` make coexistence impossible; pacman
23
# performs the switch in a single transaction in either direction.
24
# `provides=` is deliberately ABSENT: none of the three packages
25
# provides a sibling's name (no cachyos rebrand contract exists for
26
# this project — the source PKGBUILD has no provides= either), so
27
# `pacman -S <sibling>` remains a working one-command switch in both
28
# directions.
29
#
30
# There is no install hook (the source package ships none) and no
31
# optdepends: every feature is in the prebuilt binary (the Rust
32
# scx_loader/zbus bridge is statically linked into the app).
33
34
pkgname=scx-manager-bin
35
pkgver=1.15.12
36
pkgrel=1
37
pkgdesc="Prebuilt x86_64 binary of scx-manager (Qt6 GUI manager for sched-ext (SCX) schedulers) — installs without building"
38
arch=(x86_64)
39
url="https://github.com/MadGoatHaz/scx-manager"
40
license=(GPL-3.0-or-later)
41
# Same file set as the source + git packages: symmetric conflicts make
42
# coexistence impossible, and `pacman -S <sibling>` is a one-command
43
# switch in either direction (see FILE COLLISION CONTRACT in the header).
44
conflicts=(scx-manager scx-manager-git)
45
# Floors = the release-bin build environment's actuals, captured by
46
# the "Build audit" section appended to the v1.15.12 release notes
47
# (run 34546612569, 2026-09-11: qt6-base 6.11.2-3, polkit 127-3,
48
# scx-tools 1.1.3-1; glibc 2.44, GCC 16.2.1, cmake 4.4.3, rustc
49
# 1.98.1 — archlinux:base-devel container). Names are final (mirror
50
# the source depends=).
51
# QUOTED entries — an unquoted >= is a bash redirection syntax error.
52
depends=("qt6-base>=6.11.2" "polkit>=127" "scx-tools>=1.1.3")
53
# -bin model: package() installs a prebuilt, checksum-pinned tarball
54
# from GitHub Releases — there is NO compile step, so no makedepends
55
# (no cmake, no cargo, no CPM network fetches in the user's chroot).
56
makedepends=()
57
58
# Prebuilt Release tarball from the trusted upstream (the same GitHub
59
# account that hosts the source archives). Naming contract of
60
# release-bin.yml: scx-manager-<ver>-x86_64.tar.zst with a `usr/`
61
# root, so a plain extraction into $pkgdir yields the FHS tree.
62
source=("https://github.com/MadGoatHaz/scx-manager/releases/download/v${pkgver}/scx-manager-${pkgver}-x86_64.tar.zst")
63
64
# Verified via the standing double-fetch discipline (fetch twice, cmp
65
# byte-identical, sha256sum both + the released SHA256SUMS) after the
66
# first release-bin run — plans/PLAN.md §5.3-5.4.
67
# v1.15.12: a73a26d0… (run 34546612569, 2026-09-11; 2,492,271 bytes;
68
# released SHA256SUMS lists the identical hash).
69
sha256sums=("a73a26d0975e4e5bf9056b59c6656f0b7f2b4fd69508dfe3528f4edb863e9f95")
70
71
package() {
72
# The tarball's root is `usr/`, so a plain extraction into $pkgdir
73
# yields the full FHS layout (binary, libscxctl-ui.so.1*, headers,
74
# cmake config, desktop file, icon, LICENSE — provenance:
75
# CMakeLists.txt:202-238 + packaging/scx-manager/PKGBUILD:39-45).
76
# No compilation.
77
tar --zstd -xf "${srcdir}/scx-manager-${pkgver}-x86_64.tar.zst" -C "$pkgdir"
78
}
79
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-11 01:21:31 | Low | 2 |