archman-bin

LOW

maintainer Dominiquini 1 votes scanned 2026-09-05 16:00:23.828148

View on AUR

Why flagged

The package downloads a prebuilt binary from a GitHub release, which is a supply-chain risk if the host is compromised, but the source is from a project-owned repository and the binary is installed directly without obfuscation or remote code execution.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt binary from a GitHub release, which is a supply-chain risk if the host is compromised, but the source is from a project-owned repository and the binary is installed directly without obfuscation or remote code execution.

PKGBUILD

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      2
    
      3_gitauthor=ankur3-101106
    
      4_gitname=pacman-utils
    
      5_appname=archman
    
      6pkgname=${_appname}-bin
    
      7pkgdesc="All available pacman options combined into one interactive script"
    
      8
    
      9pkgver=2.0.0
    
      10pkgrel=1
    
      11_gitversion=v${pkgver}
    
      12
    
      13arch=('x86_64' 'aarch64')
    
      14_barch=('linux-x86_64' 'linux-aarch64')
    
      15
    
      16_ghurl="https://github.com/${_gitauthor}/${_gitname}"
    
      17_ghurlraw="https://raw.githubusercontent.com/${_gitauthor}/${_gitname}/${_gitversion}"
    
      18url=${_ghurl}
    
      19
    
      20license=('GPL-2.0')
    
      21
    
      22provides=("${_appname}")
    
      23conflicts=("${pkgname%-bin}")
    
      24
    
      25depends=('pacman' 'pacman-contrib')
    
      26optdepends=('yay' 'paru' 'reflector')
    
      27
    
      28options=('!strip')
    
      29
    
      30source=("README-${pkgver}.md::${_ghurlraw}/README.md"
    
      31		"LICENSE-${pkgver}::${_ghurlraw}/LICENSE")
    
      32source_x86_64=("${_appname}-${arch[0]}-${pkgver}::${_ghurl}/releases/download/${_gitversion}/${_appname}")
    
      33sha256sums=('e2caefd82f83a5490e6aaaa8d652417a1f53afa545fc40d600e58633f06388a5'
    
      34            '8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643')
    
      35sha256sums_x86_64=('065fdc344bca95036d1e8c636beab823884c69c80ee6e94eb08eb7da0d379366')
    
      36
    
      37
    
      38package() {
    
      39	cd "${srcdir}/" || exit
    
      40
    
      41	install -Dm755 "${_appname}-${CARCH}-${pkgver}" "${pkgdir}/usr/bin/${_appname}"
    
      42
    
      43	install -Dm644 "README-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      44
    
      45	install -Dm644 "LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      46}
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-05 16:00:23	Low	2