winexe
maintainer rubin55
· 0 votes
· scanned 2026-08-18 00:03:42.021799
LOW
View on AUR ↗
Why flagged
The source is a tarball from the official samba.org domain, which is the project's legitimate release host; building from upstream source is normal AUR packaging practice and poses no supply-chain risk.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the official samba.org domain, which is the project's legitimate release host; building from upstream source is normal AUR packaging practice and poses no supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:33
"https://download.samba.org/samba/ftp/stable/${_sambapkg}-${pkgver}.tar.gz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Rubin Simons <me@rubin55.org>
2
3
pkgname=winexe
4
pkgver=4.24.6
5
pkgrel=1
6
pkgdesc='Remote Windows command executor via SMB (from samba/examples/winexe)'
7
arch=('x86_64')
8
url='https://www.samba.org/'
9
license=('GPL3')
10
install=winexe.install
11
12
# ABI lock: winexe links against /usr/lib/samba/lib*-private-samba.so shipped
13
# by the official samba package, so the version should match exactly.
14
# The "2:" prefix is samba's epoch (it has used epoch=2 since 2012).
15
_sambaepoch=2
16
depends=("samba=${_sambaepoch}:${pkgver}")
17
18
# We use the MSVCRT-targeted mingw-w64 toolchain (from AUR) so the embedded
19
# winexesvc.exe service binaries link against msvcrt.dll and therefore run
20
# on every Windows since NT 4.0 SP6. The UCRT-based mingw-w64-gcc in [extra]
21
# would limit support to Windows 10+ (or Vista/7/8 with KB2999226).
22
makedepends=(
23
'mingw-w64-gcc-msvcrt'
24
'perl-parse-yapp'
25
'cmocka'
26
'bison'
27
'flex'
28
'patchelf'
29
)
30
31
_sambapkg=samba
32
source=(
33
"https://download.samba.org/samba/ftp/stable/${_sambapkg}-${pkgver}.tar.gz"
34
"https://download.samba.org/samba/ftp/stable/${_sambapkg}-${pkgver}.tar.asc"
35
'NOTES'
36
'winexe.install'
37
)
38
validpgpkeys=('81F5E2832BD2545A1897B713AA99442FB680B620') # Samba Distribution Verification Key
39
sha256sums=('810cc955acb367e9bde556dccfb50db177a02b7c553aa1629a0b905fa7616267'
40
'SKIP'
41
'989cee777ca19230f03623357e9bdc8eb33fce17230790c466aa013ecc6c9ba9'
42
'cbd542ccd943ae95fb856ba7850ebc1ab5b03da5fe0649dafc989dd3b5bd77a0')
43
44
build() {
45
cd "${srcdir}/${_sambapkg}-${pkgver}"
46
47
# Mirror the configure flags from the official Arch `samba` PKGBUILD so the
48
# winexe binary we produce is ABI-compatible with /usr/lib/samba/*.so on
49
# the user's system. The only addition is --with-winexe.
50
local _samba4_idmap_modules=idmap_ad,idmap_rid,idmap_adex,idmap_hash,idmap_tdb2
51
local _samba4_pdb_modules=pdb_tdbsam,pdb_ldap,pdb_ads,pdb_smbpasswd,pdb_wbc_sam,pdb_samba4
52
local _samba4_auth_modules=auth_unix,auth_wbc,auth_server,auth_netlogond,auth_script,auth_samba4
53
54
./configure --enable-fhs \
55
--prefix=/usr \
56
--sysconfdir=/etc \
57
--sbindir=/usr/bin \
58
--libdir=/usr/lib \
59
--libexecdir=/usr/lib/samba \
60
--localstatedir=/var \
61
--with-configdir=/etc/samba \
62
--with-lockdir=/var/cache/samba \
63
--with-sockets-dir=/run/samba \
64
--with-piddir=/run \
65
--with-ads \
66
--with-ldap \
67
--with-winbind \
68
--with-acl-support \
69
--with-systemd \
70
--with-pam \
71
--with-pammodulesdir=/usr/lib/security \
72
--private-libraries='!ldb' \
73
--bundled-libraries='!tdb,!talloc,!pytalloc-util,!tevent,!popt,!pyldb-util' \
74
--with-shared-modules="${_samba4_idmap_modules},${_samba4_pdb_modules},${_samba4_auth_modules},vfs_io_uring" \
75
--disable-rpath-install \
76
--with-profiling-data \
77
--with-winexe
78
79
PYTHONHASHSEED=1 ./buildtools/bin/waf build --targets=winexe -j"$(nproc)"
80
}
81
82
package() {
83
cd "${srcdir}/${_sambapkg}-${pkgver}"
84
85
install -Dm755 bin/default/examples/winexe/winexe \
86
"${pkgdir}/usr/bin/winexe"
87
88
mkdir -p "${pkgdir}/usr/share/man/man1"
89
gzip -c docs/manpages/winexe.1 > "${pkgdir}/usr/share/man/man1/winexe.1.gz"
90
91
# The build directory's RUNPATH is baked in; rewrite it to point at the
92
# samba package's private library directory.
93
patchelf --set-rpath /usr/lib/samba "${pkgdir}/usr/bin/winexe"
94
95
install -Dm644 examples/winexe/README \
96
"${pkgdir}/usr/share/doc/${pkgname}/README"
97
install -Dm644 "${srcdir}/NOTES" \
98
"${pkgdir}/usr/share/doc/${pkgname}/NOTES"
99
}
100
Changes since previous scan
--- PKGBUILD @ 2026-08-14 00:03+++ PKGBUILD @ 2026-08-18 00:03@@ -1,7 +1,7 @@ # Maintainer: Rubin Simons <me@rubin55.org> pkgname=winexe-pkgver=4.24.5+pkgver=4.24.6 pkgrel=1 pkgdesc='Remote Windows command executor via SMB (from samba/examples/winexe)' arch=('x86_64')@@ -36,7 +36,7 @@ 'winexe.install' ) validpgpkeys=('81F5E2832BD2545A1897B713AA99442FB680B620') # Samba Distribution Verification Key-sha256sums=('6d5d7ee82f5ce9da4135086c9b184e47a58b4b023565f58abbb1f8c8a922306b'+sha256sums=('810cc955acb367e9bde556dccfb50db177a02b7c553aa1629a0b905fa7616267' 'SKIP' '989cee777ca19230f03623357e9bdc8eb33fce17230790c466aa013ecc6c9ba9' 'cbd542ccd943ae95fb856ba7850ebc1ab5b03da5fe0649dafc989dd3b5bd77a0')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-18 00:03:42 | LOW | 2 |
| 2026-08-17 00:18:29 | LOW | 2 |
| 2026-08-16 11:32:23 | MEDIUM | 1 |
| 2026-08-14 00:03:41 | CLEAN | 2 |
| 2026-08-13 19:26:43 | MEDIUM | 1 |
| 2026-07-05 00:27:08 | CLEAN | 2 |
| 2026-07-04 11:14:02 | MEDIUM | 1 |
| 2026-06-19 23:51:18 | CLEAN | 2 |
| 2026-06-19 19:07:35 | LOW | 2 |
| 2026-06-19 18:54:17 | LOW | 2 |
| 2026-06-18 16:11:54 | MEDIUM | 1 |