washy-washy-cli-bin
LOW
maintainer alrayyes
0 votes
scanned 2026-09-01 09:47:42.175833
Why flagged
The package installs a prebuilt binary from GitHub releases, which is a normal practice for AUR binary packages; the source is verifiable, checksums are provided, and no malicious behavior is evident.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from GitHub releases, which is a normal practice for AUR binary packages; the source is verifiable, checksums are provided, and no malicious behavior is evident.
PKGBUILD
1
# Maintainer: Ryan Kes <ryan@andthensome.nl>
2
#
3
# Binary package: the release job already produces a Bun-compiled,
4
# self-contained Linux binary per arch (see openspec/changes/
5
# add-os-packaging/design.md) and this just places it, plus the man
6
# page. No build() step, no makedepends -- there is nothing to compile.
7
#
8
# source= points at github.com release assets, never git.higherlearning.eu
9
# -- that instance returns a 404 on anonymous fetches even for public
10
# repos, confirmed on the now-archived scaffold-arch-package.
11
pkgname=washy-washy-cli-bin
12
pkgver=3.1.3
13
pkgrel=1
14
pkgdesc="Turns a JSON chart of laundry piles into a phone PDF and a printable PDF"
15
arch=('x86_64' 'aarch64')
16
url="https://github.com/alrayyes/washy-washy-cli"
17
license=('GPL-3.0-or-later')
18
provides=('washy-washy-cli')
19
conflicts=('washy-washy-cli')
20
# namcap wants glibc declared explicitly even though it's always present
21
# on Arch -- it detected the binary's real dynamic dependencies directly
22
# (confirmed via ldd: libc, libpthread, libdl, libm, the dynamic linker --
23
# nothing else, since the release job builds with Bun's official install,
24
# never a distro-repackaged one; see design.md for why that distinction
25
# turned out to matter).
26
depends=('glibc')
27
# makepkg's default tidy pass runs `strip` on every binary it packages.
28
# That corrupts a `bun build --compile` executable -- confirmed directly:
29
# a stripped copy still ran, but silently fell back to Bun's own CLI menu
30
# instead of the embedded script's output, for every argument tried
31
# including --help. !debug skips gdb-add-index for the same binary,
32
# which only ever logged "No debugging symbols" noise, never usefully.
33
# The remaining namcap warnings (unstripped, lacks PIE/RELRO, "unused"
34
# libc/libpthread/libdl) are all consequences of packaging someone else's
35
# prebuilt binary rather than compiling from source here -- there's no
36
# LDFLAGS this PKGBUILD controls, and unstripped is the point, not an
37
# oversight.
38
options=(!strip !debug)
39
source_x86_64=(
40
"washy-washy-cli-$pkgver-$CARCH::https://github.com/alrayyes/washy-washy-cli/releases/download/v$pkgver/washy-washy-cli-linux-x64"
41
"washy-washy-cli.1.gz::https://github.com/alrayyes/washy-washy-cli/releases/download/v$pkgver/washy-washy-cli.1.gz"
42
)
43
source_aarch64=(
44
"washy-washy-cli-$pkgver-$CARCH::https://github.com/alrayyes/washy-washy-cli/releases/download/v$pkgver/washy-washy-cli-linux-arm64"
45
"washy-washy-cli.1.gz::https://github.com/alrayyes/washy-washy-cli/releases/download/v$pkgver/washy-washy-cli.1.gz"
46
)
47
# Real checksums are filled in by the AUR-publish job (`updpkgsums`)
48
# against that release's actual assets -- these are placeholders until
49
# the first tagged release exists to compute them against.
50
sha256sums_x86_64=('101f1455b4cf4ca7484b39ccc5e94f3ad59480478ba919c98c54587a475345ad'
51
'cd9117e5681a43f0fadb9848074d022c3e5a37b57ae7be18e1aad90e2caa95dc')
52
sha256sums_aarch64=('101f1455b4cf4ca7484b39ccc5e94f3ad59480478ba919c98c54587a475345ad'
53
'cd9117e5681a43f0fadb9848074d022c3e5a37b57ae7be18e1aad90e2caa95dc')
54
55
# No LICENSE install: this PKGBUILD lives alone in the AUR git repo, with
56
# nothing else from the upstream checkout beside it, and it isn't in
57
# `source=` either -- `license=()` plus `url=` above is what AUR expects
58
# for that case.
59
package() {
60
install -Dm755 "washy-washy-cli-$pkgver-$CARCH" "$pkgdir/usr/bin/washy-washy-cli"
61
install -Dm644 "washy-washy-cli.1.gz" "$pkgdir/usr/share/man/man1/washy-washy-cli.1.gz"
62
}
63
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-01 09:47:42 | Low | 2 |