wetype-linux

LOW

maintainer Aliorpse 0 votes scanned 2026-11-02 20:03:06.122793

View on AUR

Why flagged

The package builds from source and downloads Tencent's Windows engine during build, which is verified against a lockfile; no untrusted remote code execution or exfiltration is present, and the download is part of the intended functionality.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source and downloads Tencent's Windows engine during build, which is verified against a lockfile; no untrusted remote code execution or exfiltration is present, and the download is part of the intended functionality.

PKGBUILD

      1# Maintainer: Aliorpse <aliorpse@qq.com>
    
      2pkgname=wetype-linux
    
      3pkgver=0.1.0+wetype3.0.2.22
    
      4pkgrel=1
    
      5pkgdesc="WeType (微信输入法) engine for Fcitx5, running the Windows engine under Wine"
    
      6arch=('x86_64')
    
      7url="https://github.com/Aliorpse/wetype-linux"
    
      8license=('MIT')
    
      9depends=('fcitx5' 'wine' 'hicolor-icon-theme')
    
      10# rustup conflicts with the distro rust package: build in a clean chroot
    
      11# (devtools) if you already have rust installed.
    
      12makedepends=('rustup' 'mingw-w64-gcc' 'meson' 'ninja' 'pkgconf' '7zip' 'git' 'protobuf')
    
      13source=("git+${url}.git#tag=v${pkgver}")
    
      14sha256sums=('SKIP')
    
      15install=wetype-linux.install
    
      16
    
      17build() {
    
      18  cd "$srcdir/$pkgname"
    
      19
    
      20  # The engine host is a Windows PE; the distro rust ships only the host std.
    
      21  rustup default stable
    
      22  rustup target add x86_64-pc-windows-gnu
    
      23
    
      24  # Tencent's payload is downloaded on the build machine and verified against
    
      25  # wetype.lock; this package never redistributes it.
    
      26  ./scripts/fetch_wetype.sh
    
      27  ./scripts/build.sh
    
      28}
    
      29
    
      30package() {
    
      31  cd "$srcdir/$pkgname"
    
      32  ./scripts/install.sh --destdir "$pkgdir"
    
      33  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-02 20:03:06	Low	2