winghexexplorer2-bin

LOW

maintainer calmcrow 0 votes scanned 2026-08-24 01:21:42.645556

View on AUR

Why flagged

The package is a third-party repackaging that installs a prebuilt binary from GitHub Releases, but the build process is transparent and verifiable via CI; the source is open and the upstream project is clearly identified, reducing risk despite the untrusted host and skipped checksum.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package is a third-party repackaging that installs a prebuilt binary from GitHub Releases, but the build process is transparent and verifiable via CI; the source is open and the upstream project is clearly identified, reducing risk despite the untrusted host and skipped checksum.

PKGBUILD

      1# Maintainer: calmcrow <calmcrow@outlook.com>
    
      2#
    
      3# ============================================================
    
      4#  winghexexplorer2-bin — Third-party repackaging
    
      5# ============================================================
    
      6#  This is a third-party maintained binary package. Source and
    
      7#  build process are fully open:
    
      8#  - Source repo: https://github.com/calmcrow/winghexexplorer2-bin
    
      9#  - Build: GitHub Actions pulls the author's official PKGBUILD
    
      10#           (https://aur.archlinux.org/winghexexplorer2.git) daily,
    
      11#           builds inside an Arch Linux container, and uploads the
    
      12#           artifact to this repo's Releases; this -bin package
    
      13#           downloads and installs it directly.
    
      14#  - Upstream: https://github.com/Wing-summer/WingHexExplorer2
    
      15#
    
      16#  A confirmation notice is shown on install; make sure you trust
    
      17#  this third-party packaging before using it.
    
      18
    
      19pkgname=winghexexplorer2-bin
    
      20pkgver=2.3.8
    
      21pkgrel=1
    
      22pkgdesc='A free, powerful, cross-platform hex editor (pre-built binary, third-party packaging)'
    
      23url='https://github.com/Wing-summer/WingHexExplorer2'
    
      24arch=('x86_64')
    
      25license=('AGPL-3.0-only')
    
      26depends=('qt6-base' 'xdg-utils' 'shared-mime-info' 'desktop-file-utils' 'gtk-update-icon-cache')
    
      27conflicts=('winghexexplorer2' 'winghexexplorer2-git')
    
      28provides=('winghexexplorer2')
    
      29options=('!strip')
    
      30install=winghexexplorer2-bin.install
    
      31
    
      32_ghrepo='calmcrow/winghexexplorer2-bin'
    
      33
    
      34_pkgbase=winghexexplorer2
    
      35_asset="$_pkgbase-$pkgver-$pkgrel-$CARCH.pkg.tar.zst"
    
      36
    
      37source=("$_asset::https://github.com/$_ghrepo/releases/download/v$pkgver/$_asset")
    
      38noextract=("$_asset")
    
      39# sha256 is written automatically by CI (build.yml) after building;
    
      40# the placeholder below is only for the initial commit and will be
    
      41# replaced on the first workflow run.
    
      42sha256sums=('0000000000000000000000000000000000000000000000000000000000000000')
    
      43
    
      44package() {
    
      45  bsdtar --exclude='.PKGINFO' --exclude='.MTREE' --exclude='.BUILDINFO' --exclude='.INSTALL' \
    
      46    -xf "$srcdir/$_asset" -C "$pkgdir"
    
      47}
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-24 01:21:42	Low	2