uuway-git

LOW

maintainer zyk 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

All sources are from official/project-owned hosts (GitHub, dl.winehq.org); the Wine .deb files are from WineHQ's official distribution server with valid checksums, and the build process simply extracts and uses them locally. The SKIP'd checksums are on git sources (normal) and one tarball. No obfuscation, no exfiltration, no untrusted prebuilt executables from swappable hosts.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): All sources are from official/project-owned hosts (GitHub, dl.winehq.org); the Wine .deb files are from WineHQ's official distribution server with valid checksums, and the build process simply extracts and uses them locally. The SKIP'd checksums are on git sources (normal) and one tarball. No obfuscation, no exfiltration, no untrusted prebuilt executables from swappable hosts.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 "${_wine_deb}::https://dl.winehq.org/wine-builds/ubuntu/pool/main/w/wine/${_wine_deb}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zyk-miao <45023244+zyk-miao@users.noreply.github.com>
    
      2pkgname=uuway-git
    
      3pkgver=1.2.0.r73.gc382146
    
      4pkgrel=1
    
      5pkgdesc='NetEase UU Remote host bridge for KDE Wayland with native capture'
    
      6arch=('x86_64')
    
      7url='https://github.com/zyk-miao/UUWay'
    
      8license=('GPL-3.0-or-later' 'LGPL-2.1-or-later' 'MIT')
    
      9depends=('nvidia-utils' 'lib32-nvidia-utils' 'vulkan-icd-loader' 'pipewire' 'gst-plugins-base-libs'
    
      10         'json-c' 'libx11' 'libxfixes' 'fcitx5' 'python' 'python-gobject' 'python-dbus'
    
      11         'libappindicator' 'xdg-desktop-portal-kde' 'kscreen' 'lib32-glibc'
    
      12         'lib32-freetype2' 'lib32-libpng' 'xorg-server-xvfb' 'xclip' 'gtk3'
    
      13         'libunwind' 'libxext' 'libpulse' 'alsa-lib' 'gnutls'
    
      14         'lib32-libx11' 'lib32-libxext' 'lib32-alsa-lib' 'lib32-libpulse'
    
      15         'lib32-glib2' 'lib32-systemd' 'lib32-gnutls')
    
      16optdepends=('sane: optional Wine scanner support'
    
      17            'libgphoto2: optional Wine camera support'
    
      18            'perl: optional Wine development utilities')
    
      19makedepends=('wine' 'cuda' 'git' 'gcc' 'mingw-w64-gcc' 'meson' 'ninja' 'glslang' 'vulkan-headers'
    
      20             'pkgconf' 'curl' 'ripgrep' 'binutils')
    
      21provides=('uuway')
    
      22conflicts=('uuway')
    
      23_wine_deb='wine-stable-amd64_11.0.0.0~noble-1_amd64.deb'
    
      24_wine_main='wine-stable_11.0.0.0~noble-1_amd64.deb'
    
      25_wine_i386='wine-stable-i386_11.0.0.0~noble-1_i386.deb'
    
      26source=('uuway::git+https://github.com/zyk-miao/UUWay.git'
    
      27        "${_wine_deb}::https://dl.winehq.org/wine-builds/ubuntu/pool/main/w/wine/${_wine_deb}"
    
      28        "${_wine_main}::https://dl.winehq.org/wine-builds/ubuntu/pool/main/w/wine/${_wine_main}"
    
      29        "${_wine_i386}::https://dl.winehq.org/wine-builds/ubuntu/pool/main/w/wine/${_wine_i386}"
    
      30        'dxvk::git+https://github.com/doitsujin/dxvk.git#commit=70d7508c01201ed3d4bfb33da42ba834eafe3857'
    
      31        'wine-source-11.0.tar.gz::https://codeload.github.com/wine-mirror/wine/tar.gz/db11d0fe6a169c457e23d007e20404643d067aa8'
    
      32        'nv-codec-headers::git+https://github.com/FFmpeg/nv-codec-headers.git#commit=e844e5b26f46bb77479f063029595293aa8f812d'
    
      33        'directx::git+https://github.com/Joshua-Ashton/mingw-directx-headers.git#commit=9df86f2341616ef1888ae59919feaa6d4fad693d'
    
      34        'spirv::git+https://github.com/KhronosGroup/SPIRV-Headers.git#commit=04f10f650d514df88b76d25e83db360142c7b174'
    
      35        'vulkan::git+https://github.com/KhronosGroup/Vulkan-Headers.git#commit=8864cdc896bbc2a9b6eb36b3218fc9ef57908d77'
    
      36        'dxbc-spirv::git+https://github.com/doitsujin/dxbc-spirv.git#commit=37a97745bddaf56d717253b0e4565904ce5eb06c'
    
      37        'display-info::git+https://github.com/doitsujin/libdisplay-info.git#commit=275e6459c7ab1ddd4b125f28d0440716e4888078'
    
      38        'spirv-headers::git+https://github.com/KhronosGroup/SPIRV-Headers.git#commit=c8ad050fcb29e42a2f57d9f59e97488f465c436d'
    
      39        'dxvk-3.1.tar.gz::https://github.com/doitsujin/dxvk/releases/download/v3.1/dxvk-3.1.tar.gz')
    
      40sha256sums=('SKIP'
    
      41            '6cb835e2171b5572b17f1c06729735c2c7e40178239d7fa6c29ef14bd9b40d16'
    
      42            '04e7b4b995262c734019099d93277d8f219f7d180ebb65b5ccb3df7f97be1078'
    
      43            'b322b50f9e8bd59687840d9a7bad10d70b12ef9bdb873298e858ff93a6205e56'
    
      44            'SKIP' '18aaee150ad540885b9706ae73ccf6febca904049de2792199a9dc18a2772e6a'
    
      45            'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP'
    
      46            '30f9cc326874be344285582275446968cfa4c069db31ce56df312d6644179154')
    
      47
    
      48pkgver() {
    
      49    cd "$srcdir/uuway"
    
      50    printf '1.2.0.r%s.g%s' "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      51}
    
      52
    
      53prepare() {
    
      54    mkdir -p "$srcdir/wine"
    
      55    bsdtar -xOf "$srcdir/$_wine_deb" data.tar.zst | bsdtar -xf - -C "$srcdir/wine"
    
      56    bsdtar -xOf "$srcdir/$_wine_main" data.tar.zst | bsdtar -xf - -C "$srcdir/wine"
    
      57    bsdtar -xOf "$srcdir/$_wine_i386" data.tar.zst | bsdtar -xf - -C "$srcdir/wine"
    
      58    [[ -x "$srcdir/wine/opt/wine-stable/bin/winegcc" ]] || return 1
    
      59    [[ -f "$srcdir/wine/opt/wine-stable/lib/wine/i386-windows/kernel32.dll" ]] || return 1
    
      60
    
      61    local tree="$srcdir/uuway"
    
      62    install -dm755 "$tree/build/dxvk-capture" "$tree/build/gpu-relay/downloads"
    
      63    cp -aT "$srcdir/dxvk" "$tree/build/dxvk-capture/source-v3.1"
    
      64    install -dm755 "$tree/build/gpu-relay/wine-review"
    
      65    bsdtar -xf "$srcdir/wine-source-11.0.tar.gz" -C "$tree/build/gpu-relay/wine-review" \
    
      66        --strip-components 1 wine-db11d0fe6a169c457e23d007e20404643d067aa8/include
    
      67    cp -aT "$srcdir/nv-codec-headers" "$tree/build/gpu-relay/nv-codec-headers"
    
      68    install -m644 "$srcdir/dxvk-3.1.tar.gz" "$tree/build/gpu-relay/downloads/dxvk-3.1.tar.gz"
    
      69    local dxvk="$tree/build/dxvk-capture/source-v3.1"
    
      70    git -C "$dxvk" submodule init
    
      71    local path repo
    
      72    for mapping in 'include/native/directx directx' 'include/spirv spirv' \
    
      73                   'include/vulkan vulkan' 'subprojects/dxbc-spirv dxbc-spirv' \
    
      74                   'subprojects/libdisplay-info display-info'; do
    
      75        read -r path repo <<< "$mapping"
    
      76        git -C "$dxvk" config "submodule.$path.url" "$srcdir/$repo"
    
      77    done
    
      78    git -C "$dxvk" -c protocol.file.allow=always submodule update --init --depth 1
    
      79    local dxbc="$dxvk/subprojects/dxbc-spirv"
    
      80    git -C "$dxbc" submodule init
    
      81    git -C "$dxbc" config submodule.submodules/spirv_headers.url "$srcdir/spirv-headers"
    
      82    git -C "$dxbc" -c protocol.file.allow=always submodule update --init --depth 1
    
      83}
    
      84
    
      85build() {
    
      86    cd "$srcdir/uuway"
    
      87    UURB_WINE_BIN="$srcdir/wine/opt/wine-stable/bin" bash packaging/arch-build.sh
    
      88}
    
      89
    
      90package() {
    
      91    cd "$srcdir/uuway"
    
      92    python packaging/stage-arch.py "$pkgdir"
    
      93    install -dm755 "$pkgdir/opt/uuway"
    
      94    cp -a --no-preserve=ownership "$srcdir/wine/opt/wine-stable" "$pkgdir/opt/uuway/wine-11.0"
    
      95    install -Dm644 "$srcdir/wine/usr/share/doc/wine-stable/copyright" \
    
      96        "$pkgdir/usr/share/licenses/$pkgname/Wine-copyright"
    
      97}
    
      98

Changes since previous scan

--- PKGBUILD @ 2026-10-14 13:22
+++ PKGBUILD @ 2026-10-17 00:21
@@ -1,6 +1,6 @@
 # Maintainer: zyk-miao <45023244+zyk-miao@users.noreply.github.com>
 pkgname=uuway-git
-pkgver=1.2.0.r65.g766c293
+pkgver=1.2.0.r73.gc382146
 pkgrel=1
 pkgdesc='NetEase UU Remote host bridge for KDE Wayland with native capture'
 arch=('x86_64')
@@ -60,11 +60,11 @@
 
     local tree="$srcdir/uuway"
     install -dm755 "$tree/build/dxvk-capture" "$tree/build/gpu-relay/downloads"
-    cp -a "$srcdir/dxvk" "$tree/build/dxvk-capture/source-v3.1"
+    cp -aT "$srcdir/dxvk" "$tree/build/dxvk-capture/source-v3.1"
     install -dm755 "$tree/build/gpu-relay/wine-review"
     bsdtar -xf "$srcdir/wine-source-11.0.tar.gz" -C "$tree/build/gpu-relay/wine-review" \
         --strip-components 1 wine-db11d0fe6a169c457e23d007e20404643d067aa8/include
-    cp -a "$srcdir/nv-codec-headers" "$tree/build/gpu-relay/nv-codec-headers"
+    cp -aT "$srcdir/nv-codec-headers" "$tree/build/gpu-relay/nv-codec-headers"
     install -m644 "$srcdir/dxvk-3.1.tar.gz" "$tree/build/gpu-relay/downloads/dxvk-3.1.tar.gz"
     local dxvk="$tree/build/dxvk-capture/source-v3.1"
     git -C "$dxvk" submodule init

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3
2026-10-15 00:28:05	Low	3
2026-10-14 15:23:11	Low	3
2026-10-14 15:20:15	Medium	3
2026-10-14 13:22:29	Low	3
2026-10-14 13:20:15	Medium	3