winexe

LOW

maintainer rubin55 0 votes scanned 2026-10-02 00:00:32.890515

View on AUR

Why flagged

The source is a tarball from the official samba.org domain, which is the project's legitimate release host; building from this source is standard practice and not a supply-chain risk despite the static analyzer flag.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the official samba.org domain, which is the project's legitimate release host; building from this source is standard practice and not a supply-chain risk despite the static analyzer flag.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:33 "https://download.samba.org/samba/ftp/stable/${_sambapkg}-${pkgver}.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Rubin Simons <me@rubin55.org>
    
      2
    
      3pkgname=winexe
    
      4pkgver=4.25.0
    
      5pkgrel=1
    
      6pkgdesc='Remote Windows command executor via SMB (from samba/examples/winexe)'
    
      7arch=('x86_64')
    
      8url='https://www.samba.org/'
    
      9license=('GPL3')
    
      10install=winexe.install
    
      11
    
      12# ABI lock: winexe links against /usr/lib/samba/lib*-private-samba.so shipped
    
      13# by the official samba package, so the version should match exactly.
    
      14# The "2:" prefix is samba's epoch (it has used epoch=2 since 2012).
    
      15_sambaepoch=2
    
      16depends=("samba=${_sambaepoch}:${pkgver}")
    
      17
    
      18# We use the MSVCRT-targeted mingw-w64 toolchain (from AUR) so the embedded
    
      19# winexesvc.exe service binaries link against msvcrt.dll and therefore run 
    
      20# on every Windows since NT 4.0 SP6. The UCRT-based mingw-w64-gcc in [extra] 
    
      21# would limit support to Windows 10+ (or Vista/7/8 with KB2999226). 
    
      22makedepends=(
    
      23  'mingw-w64-gcc-msvcrt'
    
      24  'perl-parse-yapp'
    
      25  'cmocka'
    
      26  'bison'
    
      27  'flex'
    
      28  'patchelf'
    
      29)
    
      30
    
      31_sambapkg=samba
    
      32source=(
    
      33  "https://download.samba.org/samba/ftp/stable/${_sambapkg}-${pkgver}.tar.gz"
    
      34  "https://download.samba.org/samba/ftp/stable/${_sambapkg}-${pkgver}.tar.asc"
    
      35  'NOTES'
    
      36  'winexe.install'
    
      37)
    
      38validpgpkeys=('81F5E2832BD2545A1897B713AA99442FB680B620') # Samba Distribution Verification Key
    
      39sha256sums=('2e2cb7296833b35b8f7a7fb76045e0c57adc0c2cd03264b37df5d58e40f28437'
    
      40            'SKIP'
    
      41            '989cee777ca19230f03623357e9bdc8eb33fce17230790c466aa013ecc6c9ba9'
    
      42            'cbd542ccd943ae95fb856ba7850ebc1ab5b03da5fe0649dafc989dd3b5bd77a0')
    
      43
    
      44build() {
    
      45  cd "${srcdir}/${_sambapkg}-${pkgver}"
    
      46
    
      47  # Mirror the configure flags from the official Arch `samba` PKGBUILD so the
    
      48  # winexe binary we produce is ABI-compatible with /usr/lib/samba/*.so on
    
      49  # the user's system. The only addition is --with-winexe.
    
      50  local _samba4_idmap_modules=idmap_ad,idmap_rid,idmap_adex,idmap_hash,idmap_tdb2
    
      51  local _samba4_pdb_modules=pdb_tdbsam,pdb_ldap,pdb_ads,pdb_smbpasswd,pdb_wbc_sam,pdb_samba4
    
      52  local _samba4_auth_modules=auth_unix,auth_wbc,auth_server,auth_netlogond,auth_script,auth_samba4
    
      53
    
      54  ./configure --enable-fhs \
    
      55    --prefix=/usr \
    
      56    --sysconfdir=/etc \
    
      57    --sbindir=/usr/bin \
    
      58    --libdir=/usr/lib \
    
      59    --libexecdir=/usr/lib/samba \
    
      60    --localstatedir=/var \
    
      61    --with-configdir=/etc/samba \
    
      62    --with-lockdir=/var/cache/samba \
    
      63    --with-sockets-dir=/run/samba \
    
      64    --with-piddir=/run \
    
      65    --with-ads \
    
      66    --with-ldap \
    
      67    --with-winbind \
    
      68    --with-acl-support \
    
      69    --with-systemd \
    
      70    --with-pam \
    
      71    --with-pammodulesdir=/usr/lib/security \
    
      72    --private-libraries='!ldb' \
    
      73    --bundled-libraries='!tdb,!talloc,!pytalloc-util,!tevent,!popt,!pyldb-util' \
    
      74    --with-shared-modules="${_samba4_idmap_modules},${_samba4_pdb_modules},${_samba4_auth_modules},vfs_io_uring" \
    
      75    --disable-rpath-install \
    
      76    --with-profiling-data \
    
      77    --with-winexe
    
      78
    
      79  PYTHONHASHSEED=1 ./buildtools/bin/waf build --targets=winexe -j"$(nproc)"
    
      80}
    
      81
    
      82package() {
    
      83  cd "${srcdir}/${_sambapkg}-${pkgver}"
    
      84
    
      85  install -Dm755 bin/default/examples/winexe/winexe \
    
      86    "${pkgdir}/usr/bin/winexe"
    
      87  
    
      88  mkdir -p "${pkgdir}/usr/share/man/man1"
    
      89  gzip -c docs/manpages/winexe.1 > "${pkgdir}/usr/share/man/man1/winexe.1.gz"
    
      90
    
      91  # The build directory's RUNPATH is baked in; rewrite it to point at the
    
      92  # samba package's private library directory.
    
      93  patchelf --set-rpath /usr/lib/samba "${pkgdir}/usr/bin/winexe"
    
      94
    
      95  install -Dm644 examples/winexe/README \
    
      96    "${pkgdir}/usr/share/doc/${pkgname}/README"
    
      97  install -Dm644 "${srcdir}/NOTES" \
    
      98    "${pkgdir}/usr/share/doc/${pkgname}/NOTES"
    
      99}
    
      100

Changes since previous scan

--- PKGBUILD @ 2026-09-11 00:19
+++ PKGBUILD @ 2026-10-02 00:00
@@ -1,7 +1,7 @@
 # Maintainer: Rubin Simons <me@rubin55.org>
 
 pkgname=winexe
-pkgver=4.24.7
+pkgver=4.25.0
 pkgrel=1
 pkgdesc='Remote Windows command executor via SMB (from samba/examples/winexe)'
 arch=('x86_64')
@@ -36,7 +36,7 @@
   'winexe.install'
 )
 validpgpkeys=('81F5E2832BD2545A1897B713AA99442FB680B620') # Samba Distribution Verification Key
-sha256sums=('45b7747a47452eff2b2159a44cc63eb43690d339fd1069088e023a015fed06c7'
+sha256sums=('2e2cb7296833b35b8f7a7fb76045e0c57adc0c2cd03264b37df5d58e40f28437'
             'SKIP'
             '989cee777ca19230f03623357e9bdc8eb33fce17230790c466aa013ecc6c9ba9'
             'cbd542ccd943ae95fb856ba7850ebc1ab5b03da5fe0649dafc989dd3b5bd77a0')

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2
2026-09-27 11:18:17	Medium	1
2026-09-11 00:19:22	Clean	2
2026-09-10 17:21:08	Medium	1
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2