CachyOS How the trust score is calculated
Every app has a colored trust bar with a score out of 100. It only uses real data. When there is not enough review or feedback data, the bar stays grey and shows no score.
What goes into the score?
| Signal | Weight | How it is scored |
|---|---|---|
| On-site reviews | 40% | Average star rating from visitors, smoothed by adding 3 neutral 3 star votes so one review cannot swing it, then mapped from 1 to 5 stars onto 0 to 100. |
| Community | 25% | GitHub stars on a log scale (1,000 stars is 60, 10,000 is 80, 100,000 is 100) averaged with the Arch install share from pkgstats (50% or more of reporting systems is 100). |
| Maintenance | 20% | Days since the newest of: last GitHub commit, latest GitHub release, last package update. 60 days or less is 100, 180 is 80, a year is 60, two years is 30, older is 10. Packages flagged out of date lose 15. |
| Feedback tone | 15% | Each GitHub feedback item counts as positive, neutral or negative by simple keyword matching (for example thanks or works great versus crash or broken). 50 plus 50 times the net share. |
When is a bar grey?
A bar is grey until an app has at least 3 reviews on this site or at least 5 feedback items from its GitHub. Signals that are missing are left out and the other weights are scaled up, never filled with guesses.
Where does the GitHub data come from?
For apps developed on GitHub with issues turned on, a build script reads the real star count and up to 15 issues: the 10 most reacted from the last two years and the 5 newest, skipping bots and pull requests. They are saved in the site's code, so they do not change between builds. Apps hosted elsewhere, or with issues turned off, show no GitHub section and a grey bar until visitors review them.
Why only the official CachyOS repo?
This site lists only apps packaged in the official CachyOS repo, the cachyos repository at mirror.cachyos.org. Every app installs with sudo pacman -S and updates with the rest of the system. There are no AUR build scripts and no AUR helper in any guide.
Are the packages signed?
Yes. Every one of the 209 packages used on this site carries a PGP signature in the cachyos repo index read on Nov 1, 2026. pacman checks that signature against the CachyOS repository key before it installs. The CachyOS wiki shows the key being imported with pacman-key (https://wiki.cachyos.org/features/optimized_repos/), and the CachyOS FAQ explains that the pacman keyrings verify the authenticity of packages (https://wiki.cachyos.org/cachyos_basic/faq/).
A signature shows a package came from the CachyOS packagers unchanged. It is not a review of the app itself, which is why every app also has visitor reviews, GitHub feedback and this score.
Can a score be bought or edited?
No. Sponsors appear only in labelled sponsor boxes and never change a listing, a ranking, a review or a score. There are no seeded reviews and no manual score overrides. Reviews that break the rules (spam, links, abuse) can be hidden, and hidden reviews do not count.