adcode-bin

MEDIUM

maintainer dmig 0 votes scanned 2026-10-19 15:25:12.467407

View on AUR

Why flagged

The package installs a prebuilt .deb binary from a GitHub release, which is an unverifiable executable from a potentially swappable host, creating a supply-chain risk despite the project being open-source.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt .deb binary from a GitHub release, which is an unverifiable executable from a potentially swappable host, creating a supply-chain risk despite the project being open-source.

PKGBUILD

      1# Maintainer: Dmitriy Geels <dmitry.geels@gmail.com>
    
      2
    
      3pkgname=adcode-bin
    
      4pkgver=2.3.2
    
      5pkgrel=1
    
      6pkgdesc="An ad-supported, AI-native IDE"
    
      7arch=('x86_64')
    
      8url="https://github.com/bluethenics/adcode"
    
      9license=('Apache-2.0')
    
      10
    
      11depends=(
    
      12    'gtk3'
    
      13    'libnotify'
    
      14    'nss'
    
      15    'libxss'
    
      16    'libxtst'
    
      17    'at-spi2-core'
    
      18    'util-linux-libs'
    
      19    'libsecret'
    
      20    'xdg-utils'
    
      21)
    
      22optdepends=(
    
      23    'libappindicator: system tray integration'
    
      24)
    
      25provides=('adcode')
    
      26conflicts=('adcode')
    
      27
    
      28source=(
    
      29    "${pkgname}-${pkgver}.deb::${url}/releases/download/v${pkgver}/ADCode-amd64.deb"
    
      30)
    
      31sha256sums=(
    
      32    'ccf5d983ede02f9e35236503993890ad4302f9a5af5a466c4454fc2dd6424ce3'
    
      33)
    
      34
    
      35noextract=("${pkgname}-${pkgver}.deb")
    
      36
    
      37package() {
    
      38    bsdtar -xOf "${srcdir}/${pkgname}-${pkgver}.deb" data.tar.xz |
    
      39        bsdtar -xf - -C "${pkgdir}"
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-19 15:25:12	Medium	2