What happens before an app is offered.
When in doubt, we leave it out. These are the checks, in order.
Is the licence clear?
A recognised open-source licence must be stated in the project. No licence, or an unclear one, means the app does not go in.
Is the project real and alive?
Not archived, not a copy of someone else's work, and updated recently, with a working README and real releases.
Where does it install from?
Only from an official repository or a reviewed community package. We never host or mirror other people's code.
Do we read the install scripts?
Line by line. We look for hidden network calls, obfuscation, and the habit of fetching and running more code.
Does it work on our systems?
It must actually install and run on Arch-based systems. Broken or placeholder projects are left out.
Is it checked again?
Listings are re-checked on a schedule. If a project is abandoned, archived or found to contain a problem, it is flagged or removed.
What this does not mean
Verification lowers risk; it does not remove it. We are a small team and we can miss things. If you spot something, tell us through the security page.