aoostar-lcd-bin

LOW

maintainer nietonchique 0 votes scanned 2026-10-23 11:37:13.522338

View on AUR

Why flagged

Package installs a prebuilt binary from a project-owned GitHub release, which is a normal AUR pattern; the low severity is due to unverifiable origin of the binary, but the source is from the maintainer's official repository with no signs of malicious intent.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): Package installs a prebuilt binary from a project-owned GitHub release, which is a normal AUR pattern; the low severity is due to unverifiable origin of the binary, but the source is from the maintainer's official repository with no signs of malicious intent.

PKGBUILD

      1# Maintainer: Aleksandr Ryzhkov <nietonchique@users.noreply.github.com>
    
      2# Prebuilt binary from the GitHub release tarball produced by
    
      3# .github/workflows/release.yml. For a source build see the -git variant.
    
      4_pkgname=aoostar-lcd
    
      5pkgname=${_pkgname}-bin
    
      6pkgver=1.0.1
    
      7pkgrel=1
    
      8pkgdesc='Glanceable front-panel status display for the AOOSTAR WTR MAX home server'
    
      9arch=('x86_64')
    
      10url='https://github.com/nietonchique/aoostar-lcd'
    
      11license=('MIT' 'Apache')
    
      12depends=('glibc' 'gcc-libs' 'systemd-libs')
    
      13optdepends=('smartmontools: disk temperatures and SMART health data'
    
      14            'zfs-utils: ZFS pool usage page'
    
      15            'nvidia-utils: GPU telemetry via nvidia-smi'
    
      16            'docker: container CPU/RAM statistics')
    
      17provides=("${_pkgname}=${pkgver}")
    
      18conflicts=("${_pkgname}")
    
      19backup=('etc/aoostar-lcd.toml')
    
      20# The `name::url` form keeps a version+arch-unique local filename in the
    
      21# makepkg cache. Checksum below must be updated from the release's
    
      22# SHA256SUMS.txt asset (or `updpkgsums`) on every version bump.
    
      23source=("${_pkgname}-v${pkgver}-x86_64-unknown-linux-gnu.tar.gz::${url}/releases/download/v${pkgver}/${_pkgname}-v${pkgver}-x86_64-unknown-linux-gnu.tar.gz")
    
      24sha256sums=('c610ec7b7c6a9f63eff5fe7d2e62f2f3e870a2e37accc6c04f5087b44dc9489f')
    
      25
    
      26# No build(): nothing to compile, no makedepends. The tarball carries a
    
      27# top-level dir that makepkg extracts into $srcdir automatically.
    
      28package() {
    
      29  cd "${_pkgname}-v${pkgver}-x86_64-unknown-linux-gnu"
    
      30
    
      31  install -Dm755 aoostar-lcd       "${pkgdir}/usr/bin/aoostar-lcd"
    
      32  install -Dm644 aoostar-lcd.service "${pkgdir}/usr/lib/systemd/system/aoostar-lcd.service"
    
      33  # pacman protects /etc: modified files are kept on upgrade, the new one
    
      34  # lands as /etc/aoostar-lcd.toml.pacnew (declared via backup=()).
    
      35  install -Dm644 config.example.toml "${pkgdir}/etc/aoostar-lcd.toml"
    
      36
    
      37  install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      38  install -Dm644 LICENSE-MIT    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE-MIT"
    
      39  install -Dm644 LICENSE-APACHE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE-APACHE"
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-23 11:37:13	Low	2