amp-desktop-bin

LOW

maintainer rockorager 0 votes scanned 2026-11-02 18:02:51.835640

View on AUR

Why flagged

The package re-packages official .deb files from the vendor's static domain with fixed checksums; while the host is not on a common whitelist, the binaries are verifiable and the build process is transparent, limiting risk to typical proprietary software concerns.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package re-packages official .deb files from the vendor's static domain with fixed checksums; while the host is not on a common whitelist, the binaries are verifiable and the build process is transparent, limiting risk to typical proprietary software concerns.

PKGBUILD

      1# Maintainer: Amp <https://ampcode.com>
    
      2#
    
      3# Repackages the desktop app's .deb, which already carries the .desktop file (with the sign-in
    
      4# callback scheme) and the icon. Publishing a version sets pkgver and both checksums to the debs it
    
      5# uploaded; see desktop/README.md.
    
      6
    
      7pkgname=amp-desktop-bin
    
      8_pkgname=amp-desktop
    
      9pkgver=0.1.29893921
    
      10pkgrel=1
    
      11pkgdesc='Amp, the frontier coding agent, as a desktop app'
    
      12arch=('x86_64' 'aarch64')
    
      13url='https://ampcode.com'
    
      14license=('LicenseRef-proprietary')
    
      15# What the Electron binary links, libnotify for notifications, and xdg-open for sign-in and links.
    
      16depends=('gtk3' 'nss' 'alsa-lib' 'libcups' 'mesa' 'libnotify' 'xdg-utils')
    
      17provides=("${_pkgname}")
    
      18conflicts=("${_pkgname}")
    
      19options=('!strip' '!debug')
    
      20_url="https://static.ampcode.com/linux/${pkgver}/${_pkgname}-${pkgver}"
    
      21# Saved under the pacman architecture name, so package() finds the right one by $CARCH.
    
      22source_x86_64=("${_pkgname}-${pkgver}-x86_64.deb::${_url}-amd64.deb")
    
      23source_aarch64=("${_pkgname}-${pkgver}-aarch64.deb::${_url}-arm64.deb")
    
      24noextract=("${_pkgname}-${pkgver}-x86_64.deb" "${_pkgname}-${pkgver}-aarch64.deb")
    
      25# Publishing (.buildkite/scripts/linux-desktop-build.sh) sets these to the debs' checksums.
    
      26sha256sums_x86_64=('3323f8dba14ff61ec247eeb3459dd9b80550ccf210306e4e525f907bdb3018df')
    
      27sha256sums_aarch64=('56286a8e3fc0e1c59265346f5a7f6ce9b9376dd7766ebc30f7f06caf6ddba0e8')
    
      28
    
      29package() {
    
      30	bsdtar -xOf "${_pkgname}-${pkgver}-${CARCH}.deb" 'data.tar.*' | bsdtar -xf - -C "${pkgdir}"
    
      31	rm -rf "${pkgdir}/usr/share/doc"
    
      32
    
      33	# The deb's install script makes this link, and pacman does not run it.
    
      34	install -dm755 "${pkgdir}/usr/bin"
    
      35	ln -s "/opt/Amp/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      36
    
      37	install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}"
    
      38	# Not `license`: makepkg reads that array after package() returns.
    
      39	for file in LICENSE.electron.txt LICENSES.chromium.html; do
    
      40		ln -s "/opt/Amp/${file}" "${pkgdir}/usr/share/licenses/${pkgname}/${file}"
    
      41	done
    
      42}
    
      43

Changes since previous scan

--- PKGBUILD @ 2026-11-02 16:02
+++ PKGBUILD @ 2026-11-02 18:02
@@ -6,7 +6,7 @@
 
 pkgname=amp-desktop-bin
 _pkgname=amp-desktop
-pkgver=0.1.29893834
+pkgver=0.1.29893921
 pkgrel=1
 pkgdesc='Amp, the frontier coding agent, as a desktop app'
 arch=('x86_64' 'aarch64')
@@ -23,8 +23,8 @@
 source_aarch64=("${_pkgname}-${pkgver}-aarch64.deb::${_url}-arm64.deb")
 noextract=("${_pkgname}-${pkgver}-x86_64.deb" "${_pkgname}-${pkgver}-aarch64.deb")
 # Publishing (.buildkite/scripts/linux-desktop-build.sh) sets these to the debs' checksums.
-sha256sums_x86_64=('3da54153e8b3fc02553a953ad9b004e7d397974557716dadbdf4273c2935cfec')
-sha256sums_aarch64=('2192375868e27a544d79056642bc34b263153ca8387707c85372f935b3317ec8')
+sha256sums_x86_64=('3323f8dba14ff61ec247eeb3459dd9b80550ccf210306e4e525f907bdb3018df')
+sha256sums_aarch64=('56286a8e3fc0e1c59265346f5a7f6ce9b9376dd7766ebc30f7f06caf6ddba0e8')
 
 package() {
 	bsdtar -xOf "${_pkgname}-${pkgver}-${CARCH}.deb" 'data.tar.*' | bsdtar -xf - -C "${pkgdir}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-02 18:02:51	Low	2
2026-11-02 16:02:37	Low	2