What happens before we ship.
Our own code and the open-source work underneath it. When in doubt, we leave it out. These are the checks, in order.
A no ends it.
Every answer here is read by a person, not accepted by a script. If an answer is no, or we cannot answer it, it does not go into a build.
Report a problemIs the licence clear?
Every project we build on has to state a recognised open-source licence. No licence, or an unclear one, means we do not build on it.
Is the project real and alive?
Not archived, not a copy of someone else's work, and updated recently, with a working README and real releases.
Where does it come from?
Only from the project's own repository or a reviewed distribution package. We never host or mirror other people's code.
Do we read the scripts?
Line by line. Every installer and setup script we ship is read for hidden network calls, obfuscation, and the habit of fetching and running more code.
Does it work on our machines?
It has to install and run on real Arch-based systems before we build on it. Broken or placeholder projects are left out.
Is it checked again?
We re-check before every release, and again when a project changes hands or goes quiet. If something turns out to contain a problem, it comes out of the build.
What this does not mean.
Verification lowers risk; it does not remove it. No check is perfect, so we keep checking, and a dependency is read again when a project changes hands or goes quiet.
If you find something our checks missed, tell us through the security page. We would rather hear it from you.