arego

MEDIUM

maintainer itzlassejlv 0 votes scanned 2026-10-30 00:29:30.650963

View on AUR

Why flagged

Installs a prebuilt binary from 'releases.arego.design', a non-standard personal/project host that cannot be independently verified as official infrastructure; the binary is executed directly and the host could be silently swapped, though a sha256 checksum is provided which mitigates (but does not eliminate) the risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("Arego-$_version-linux-x86_64.tar.gz::https://releases.arego.design/v$_version/Arego-$_version-linux-x86_64.tar.gz")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs a prebuilt binary from 'releases.arego.design', a non-standard personal/project host that cannot be independently verified as official infrastructure; the binary is executed directly and the host could be silently swapped, though a sha256 checksum is provided which mitigates (but does not eliminate) the risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: itzlassejlv <hello@lassejlv.dk>
    
      2pkgname=arego
    
      3_version=0.1.11
    
      4pkgver=${_version//-/_}
    
      5pkgrel=1
    
      6pkgdesc="Design with HTML and CSS on a native canvas"
    
      7arch=('x86_64')
    
      8url="https://arego.design"
    
      9license=('Apache-2.0')
    
      10depends=('glibc' 'gcc-libs' 'fontconfig' 'freetype2' 'libxkbcommon' 'libxkbcommon-x11' 'libxcb' 'wayland' 'vulkan-icd-loader' 'hicolor-icon-theme' 'shared-mime-info' 'desktop-file-utils')
    
      11optdepends=('vulkan-driver: GPU rendering (mesa provides one)'
    
      12            'wl-clipboard: paste rich content on Wayland'
    
      13            'xclip: paste rich content on X11'
    
      14            'org.freedesktop.secrets: remember your key (gnome-keyring, kwallet, keepassxc)')
    
      15options=('!strip' '!debug')
    
      16source=("Arego-$_version-linux-x86_64.tar.gz::https://releases.arego.design/v$_version/Arego-$_version-linux-x86_64.tar.gz")
    
      17sha256sums=('084e5e8883fc6b26b73ae7a2def057e92de31ac1a4f1b9ed537c120f3b0faa76')
    
      18
    
      19package() {
    
      20    cd "Arego-$_version-linux-x86_64"
    
      21    install -Dm755 bin/arego "$pkgdir/usr/bin/arego"
    
      22    cp -r share "$pkgdir/usr/"
    
      23    find "$pkgdir/usr/share" -type d -exec chmod 755 {} +
    
      24    find "$pkgdir/usr/share" -type f -exec chmod 644 {} +
    
      25}
    
      26

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-30 00:29:30	Medium	3
2026-10-29 21:57:52	Medium	3
2026-10-29 21:53:30	Medium	2