arithmetic-arena-bin

MEDIUM

maintainer kadrian 0 votes scanned 2026-10-07 20:08:44.287246

View on AUR

Why flagged

Prebuilt proprietary binary downloaded from the maintainer's personal website (kairollmann.de), which is an unofficial/personal host that could be silently swapped; while the checksum is present and the host matches the package's declared URL, it is still an unverifiable third-party executable with no independent release infrastructure.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://kairollmann.de/arithmeticarena/releases/1.0.0/Arithmetic-Arena_1.0.0_amd64.tar.gz")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Prebuilt proprietary binary downloaded from the maintainer's personal website (kairollmann.de), which is an unofficial/personal host that could be silently swapped; while the checksum is present and the host matches the package's declared URL, it is still an unverifiable third-party executable with no independent release infrastructure.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kai Rollmann <arithmeticarena@kairollmann.de>
    
      2pkgname=arithmetic-arena-bin
    
      3pkgver=1.0.0
    
      4pkgrel=1
    
      5pkgdesc="Mental arithmetic chains without the countdown: follow the steps, type the result, see how long it took afterwards"
    
      6arch=('x86_64')
    
      7url="https://kairollmann.de/arithmeticarena"
    
      8license=('LicenseRef-Proprietary')
    
      9depends=('webkit2gtk-4.1' 'gtk3' 'hicolor-icon-theme')
    
      10provides=('arithmetic-arena')
    
      11conflicts=('arithmetic-arena')
    
      12options=('!strip')
    
      13source=("https://kairollmann.de/arithmeticarena/releases/1.0.0/Arithmetic-Arena_1.0.0_amd64.tar.gz")
    
      14sha256sums=('7ebcd8e75c916b8884b4ceaf4ea0ae7b4f9e0dcdd278e7a49eb1793619463663')
    
      15
    
      16package() {
    
      17  cp -a "${srcdir}/usr" "${pkgdir}/"
    
      18}
    
      19

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-07 20:08:44	Medium	3
2026-10-07 20:06:42	Medium	2