wherry (CLEAN) - AURWatch

Triggered rules

Clean AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it CLEAN (confidence 95%): The source is a Git repository from a plausible project host used to build the software from source, which is normal for AUR packages; the non-whitelisted host is the project's own forge, and no untrusted prebuilt binaries are executed.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 source=("git+https://git.wihuk.pro/boba/Wherry.git#tag=v$pkgver?signed")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: loki5512344 <mauhhhh7@gmail.com>
    
      2
    
      3pkgname=wherry
    
      4pkgver=0.1.0
    
      5pkgrel=5
    
      6pkgdesc="A modern dual-pane file manager with SFTP/FTP/FTPS support"
    
      7arch=('x86_64')
    
      8url='https://git.wihuk.pro/boba/Wherry'
    
      9license=('GPL3')
    
      10depends=(
    
      11  'gcc-libs'
    
      12  'gtk3'
    
      13  'webkit2gtk-4.1'
    
      14  'libsoup3'
    
      15  'cairo'
    
      16  'gdk-pixbuf2'
    
      17  'glib2'
    
      18  'librsvg'
    
      19  'openssl'
    
      20  'libssh2'
    
      21  'dbus'
    
      22)
    
      23makedepends=('cargo' 'pkg-config' 'git')
    
      24optdepends=('mold: faster linking')
    
      25source=("git+https://git.wihuk.pro/boba/Wherry.git#tag=v$pkgver?signed")
    
      26sha256sums=('SKIP')
    
      27validpgpkeys=('CB67D9090663FFB2E21E0CB0253067914055423B')  # loki5512344
    
      28
    
      29_repodir="Wherry"
    
      30
    
      31prepare() {
    
      32  cd "$srcdir/$_repodir"
    
      33  export CARGO_TARGET_DIR="$srcdir/target"
    
      34  cargo fetch --locked --target "$CARCH-unknown-linux-gnu"
    
      35}
    
      36
    
      37build() {
    
      38  cd "$srcdir/$_repodir"
    
      39  export CARGO_TARGET_DIR="$srcdir/target"
    
      40  cargo build --release --frozen
    
      41}
    
      42
    
      43package() {
    
      44  cd "$srcdir/$_repodir"
    
      45  install -Dm755 "$srcdir/target/release/wherry" "$pkgdir/usr/bin/wherry"
    
      46  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      47  install -Dm644 src/icons/128x128.png "$pkgdir/usr/share/pixmaps/wherry.png"
    
      48  install -Dm644 dist/wherry.desktop "$pkgdir/usr/share/applications/wherry.desktop"
    
      49}
    
      50

Changes since previous scan

--- PKGBUILD @ 2026-07-15 00:09
+++ PKGBUILD @ 2026-10-30 00:29
@@ -1,11 +1,11 @@
-# Maintainer: loki5512344 <dev14dbq@gmail.com>
+# Maintainer: loki5512344 <mauhhhh7@gmail.com>
 
 pkgname=wherry
 pkgver=0.1.0
-pkgrel=1
+pkgrel=5
 pkgdesc="A modern dual-pane file manager with SFTP/FTP/FTPS support"
 arch=('x86_64')
-url='https://github.com/loki5512344/Wherry'
+url='https://git.wihuk.pro/boba/Wherry'
 license=('GPL3')
 depends=(
   'gcc-libs'
@@ -20,11 +20,13 @@
   'libssh2'
   'dbus'
 )
-makedepends=('cargo' 'pkg-config')
-source=("https://github.com/loki5512344/Wherry/archive/refs/tags/v$pkgver.tar.gz")
-sha256sums=('2c9ee91948fdad352ba797ce8652bf626797769a74e2707504184f541eecf0ab')
+makedepends=('cargo' 'pkg-config' 'git')
+optdepends=('mold: faster linking')
+source=("git+https://git.wihuk.pro/boba/Wherry.git#tag=v$pkgver?signed")
+sha256sums=('SKIP')
+validpgpkeys=('CB67D9090663FFB2E21E0CB0253067914055423B')  # loki5512344
 
-_repodir="Wherry-$pkgver"
+_repodir="Wherry"
 
 prepare() {
   cd "$srcdir/$_repodir"
@@ -35,7 +37,6 @@
 build() {
   cd "$srcdir/$_repodir"
   export CARGO_TARGET_DIR="$srcdir/target"
-  export CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER="/usr/bin/cc"
   cargo build --release --frozen
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-30 00:29:30	Clean	2
2026-10-29 21:53:30	Medium	1
2026-07-15 00:09:25	Clean	2
2026-07-14 13:45:26	Low	1