aceround-apply-bin

MEDIUM

maintainer wearzdk 0 votes scanned 2026-10-26 07:46:00.476890

View on AUR

Why flagged

Closed-source prebuilt binary downloaded from the project's own domain (dl.aceround.app), which is plausibly official but is a personal/vendor-controlled host with no independent verification possible; the binary is executed directly, and the checksum is present but only as strong as the host's integrity — low votes and recent upload add minor concern, but no obfuscation or exfiltration is visible.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("aceround-apply-${pkgver}-amd64.deb::https://dl.aceround.app/apply/aceround-apply-${pkgver}-amd64.deb")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Closed-source prebuilt binary downloaded from the project's own domain (dl.aceround.app), which is plausibly official but is a personal/vendor-controlled host with no independent verification possible; the binary is executed directly, and the checksum is present but only as strong as the host's integrity — low votes and recent upload add minor concern, but no obfuscation or exfiltration is visible.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AceRound <support@aceround.app>
    
      2#
    
      3# AceRound Auto Apply is closed source. Release CI builds the official .deb and uploads it
    
      4# to dl.aceround.app; this -bin package repackages that .deb.
    
      5#
    
      6# pkgver and sha256sums are rewritten and pushed to the AUR by the release workflow
    
      7# (publish-aur-oversea in .github/workflows/apply-release.yml). Do not edit them by hand.
    
      8pkgname=aceround-apply-bin
    
      9pkgver=0.3.3
    
      10pkgrel=1
    
      11pkgdesc="AceRound Auto Apply — AI job applications on company career sites, in your own browser, with every step visible"
    
      12arch=('x86_64')
    
      13url="https://www.aceround.app/auto-apply"
    
      14license=('LicenseRef-proprietary')
    
      15depends=('webkit2gtk-4.1' 'gtk3')
    
      16provides=('aceround-apply')
    
      17conflicts=('aceround-apply')
    
      18options=('!strip' '!debug')
    
      19install="${pkgname}.install"
    
      20source=("aceround-apply-${pkgver}-amd64.deb::https://dl.aceround.app/apply/aceround-apply-${pkgver}-amd64.deb")
    
      21noextract=("aceround-apply-${pkgver}-amd64.deb")
    
      22sha256sums=('d0c5ac78d147bba8c9de0affd05ebb9b4eeea6858eaa6e11a3029f876f6af34b')
    
      23
    
      24package() {
    
      25  cd "$srcdir"
    
      26  bsdtar -xf "aceround-apply-${pkgver}-amd64.deb"
    
      27  bsdtar -xf data.tar.*
    
      28
    
      29  install -Dm755 "usr/bin/aceround-apply" "$pkgdir/usr/bin/aceround-apply"
    
      30  install -Dm644 "usr/share/applications/aceround-apply.desktop" \
    
      31    "$pkgdir/usr/share/applications/aceround-apply.desktop"
    
      32
    
      33  for icon in usr/share/icons/hicolor/*/apps/aceround-apply.png; do
    
      34    [[ -e "$icon" ]] || continue
    
      35    install -Dm644 "$icon" "$pkgdir/$icon"
    
      36  done
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-26 07:46:00	Medium	3
2026-10-26 07:44:04	Medium	3