astrbot-desktop-bin

LOW

maintainer buding 0 votes scanned 2026-11-03 10:04:25.157601

View on AUR

Why flagged

The package installs official prebuilt binaries from the project's own GitHub releases, which is a normal practice for AUR packages; the low severity is due to unverifiable binaries, but the source is plausibly official and no malicious behavior is evident.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs official prebuilt binaries from the project's own GitHub releases, which is a normal practice for AUR packages; the low severity is due to unverifiable binaries, but the source is plausibly official and no malicious behavior is evident.

PKGBUILD

      1# Maintainer: buding <1259085392z@gmail.com>
    
      2pkgname=astrbot-desktop-bin
    
      3pkgver=4.29.4
    
      4pkgrel=1
    
      5pkgdesc='AstrBot desktop application (official prebuilt binaries)'
    
      6arch=('x86_64' 'aarch64')
    
      7url='https://github.com/AstrBotDevs/AstrBot-desktop'
    
      8license=('AGPL-3.0-only')
    
      9depends=('gtk3' 'webkit2gtk-4.1' 'libayatana-appindicator' 'gcc-libs' 'glibc')
    
      10provides=('astrbot-desktop')
    
      11conflicts=('astrbot-desktop')
    
      12options=('!strip' '!debug')
    
      13# The license is pinned independently of release tags, which may not carry source.
    
      14source=('AstrBot-LICENSE::https://raw.githubusercontent.com/AstrBotDevs/AstrBot-desktop/6cf79c322190299f0d83cb2f9001984655fcd88d/LICENSE')
    
      15sha256sums=('0d96a4ff68ad6d4b6f1f30f713b18d5184912ba8dd389f86aa7710db079abcb0')
    
      16source_x86_64=("AstrBot_${pkgver}_linux_amd64.deb::${url}/releases/download/v${pkgver}/AstrBot_${pkgver}_linux_amd64.deb")
    
      17sha256sums_x86_64=('51b488aaaa8844bd92c9731558bfb57878624c25a5c8264c3d8af458d499ce05')
    
      18source_aarch64=("AstrBot_${pkgver}_linux_arm64.deb::${url}/releases/download/v${pkgver}/AstrBot_${pkgver}_linux_arm64.deb")
    
      19sha256sums_aarch64=('13c39b6d8a3cda9a68678cb23baedba357f40da962166c7cb1354312802adc75')
    
      20noextract=("AstrBot_${pkgver}_linux_amd64.deb" "AstrBot_${pkgver}_linux_arm64.deb")
    
      21
    
      22package() {
    
      23  local debarch
    
      24  case "$CARCH" in
    
      25    x86_64) debarch=amd64 ;;
    
      26    aarch64) debarch=arm64 ;;
    
      27    *) return 1 ;;
    
      28  esac
    
      29  # Stream only the payload; Debian maintainer scripts must never run.
    
      30  bsdtar -xOf "$srcdir/AstrBot_${pkgver}_linux_${debarch}.deb" 'data.tar.*' |
    
      31    bsdtar -xf - -C "$pkgdir"
    
      32  install -Dm644 "$srcdir/AstrBot-LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-03 10:04:25	Low	2