wherry-bin

LOW

maintainer loki5512344 1 votes scanned 2026-10-30 00:29:30.650963

View on AUR

Why flagged

The package downloads a pre-compiled binary from a project-owned but non-whitelisted host; however, it is signed with a PGP key trusted to the maintainer, and the source is a standard release archive for the project, making it a low-risk supply-chain scenario.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a pre-compiled binary from a project-owned but non-whitelisted host; however, it is signed with a PGP key trusted to the maintainer, and the source is a standard release archive for the project, making it a low-risk supply-chain scenario.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source=("https://git.wihuk.pro/boba/Wherry/releases/download/v$pkgver/wherry-v$pkgver-x86_64-linux.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: loki5512344 <mauhhhh7@gmail.com>
    
      2
    
      3pkgname=wherry-bin
    
      4pkgver=0.1.0
    
      5pkgrel=3
    
      6pkgdesc="A modern dual-pane file manager with SFTP/FTP/FTPS support (pre-compiled)"
    
      7arch=('x86_64')
    
      8url='https://git.wihuk.pro/boba/Wherry'
    
      9license=('GPL3')
    
      10depends=(
    
      11  'gcc-libs'
    
      12  'gtk3'
    
      13  'webkit2gtk-4.1'
    
      14  'libsoup3'
    
      15  'cairo'
    
      16  'gdk-pixbuf2'
    
      17  'glib2'
    
      18  'librsvg'
    
      19  'openssl'
    
      20  'libssh2'
    
      21  'dbus'
    
      22)
    
      23source=("https://git.wihuk.pro/boba/Wherry/releases/download/v$pkgver/wherry-v$pkgver-x86_64-linux.tar.gz"
    
      24        "https://git.wihuk.pro/boba/Wherry/releases/download/v$pkgver/wherry-v$pkgver-x86_64-linux.tar.gz.asc")
    
      25sha256sums=('686fb6d52e090404b0be44b566f2f914cf91bede437cf4141c1e59496d925ee9'
    
      26            'SKIP')
    
      27validpgpkeys=('CB67D9090663FFB2E21E0CB0253067914055423B')  # loki5512344
    
      28
    
      29package() {
    
      30  cp -r "$srcdir/usr" "$pkgdir/"
    
      31}
    
      32

Changes since previous scan

--- PKGBUILD @ 2026-07-29 00:25
+++ PKGBUILD @ 2026-10-30 00:29
@@ -2,10 +2,10 @@
 
 pkgname=wherry-bin
 pkgver=0.1.0
-pkgrel=1
+pkgrel=3
 pkgdesc="A modern dual-pane file manager with SFTP/FTP/FTPS support (pre-compiled)"
 arch=('x86_64')
-url='https://github.com/loki5512344/Wherry'
+url='https://git.wihuk.pro/boba/Wherry'
 license=('GPL3')
 depends=(
   'gcc-libs'
@@ -20,10 +20,13 @@
   'libssh2'
   'dbus'
 )
-source=("https://github.com/loki5512344/Wherry/releases/download/v$pkgver/wherry-v$pkgver-x86_64-linux.tar.gz")
-sha256sums=('d00bedf0ea2890a18d5c506880a33f4bd87eeec2228309279a3d06b1657a7b5e')
+source=("https://git.wihuk.pro/boba/Wherry/releases/download/v$pkgver/wherry-v$pkgver-x86_64-linux.tar.gz"
+        "https://git.wihuk.pro/boba/Wherry/releases/download/v$pkgver/wherry-v$pkgver-x86_64-linux.tar.gz.asc")
+sha256sums=('686fb6d52e090404b0be44b566f2f914cf91bede437cf4141c1e59496d925ee9'
+            'SKIP')
+validpgpkeys=('CB67D9090663FFB2E21E0CB0253067914055423B')  # loki5512344
 
 package() {
-  cp -r "$srcdir"/* "$pkgdir"/
+  cp -r "$srcdir/usr" "$pkgdir/"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-30 00:29:30	Low	2
2026-10-29 21:53:30	Medium	1
2026-07-29 00:25:53	Clean	0
2026-07-28 00:07:28	Low	2
2026-07-27 00:24:32	Low	2
2026-07-26 00:07:32	Low	2
2026-07-25 00:13:44	Low	2
2026-07-24 00:02:28	Low	2
2026-07-23 00:14:47	Low	2
2026-07-22 00:29:32	Low	2
2026-07-21 00:24:15	Low	2
2026-07-20 00:19:49	Low	2
2026-07-19 00:17:08	Low	2
2026-07-18 00:14:48	Low	2
2026-07-17 00:06:16	Low	2
2026-07-16 00:05:41	Low	2
2026-07-15 00:09:25	Low	2
2026-07-14 13:45:26	Low	2