atomic-chat-bin

LOW

maintainer biogenic_ooze 0 votes scanned 2026-10-29 09:52:05.005162

View on AUR

Why flagged

The package installs a prebuilt binary from the project's official GitHub release, which is a normal practice for AUR binary packages; the low severity is due to the binary nature and recent upload with few votes, not malicious behavior.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from the project's official GitHub release, which is a normal practice for AUR binary packages; the low severity is due to the binary nature and recent upload with few votes, not malicious behavior.

PKGBUILD

      1# Maintainer: Atomic Chat <support@atomic.chat>
    
      2#
    
      3# Generated from packaging/PKGBUILD.in in https://github.com/AtomicBot-ai/Atomic-Chat by the linux-repo
    
      4# workflow (scripts/linux-packages.mjs pkgbuild); change the template there, not this copy.
    
      5
    
      6pkgname=atomic-chat-bin
    
      7pkgver=2.2.29
    
      8_version=2.2.29
    
      9pkgrel=1
    
      10pkgdesc='Local AI app and inference engine for agents: run open-weight LLMs locally (https://atomic.chat)'
    
      11arch=('x86_64' 'aarch64')
    
      12url='https://github.com/AtomicBot-ai/Atomic-Chat'
    
      13license=('Apache-2.0')
    
      14# What the payload's ELF files link (the deb's Depends, read from them, in Arch's names) and
    
      15# libayatana-appindicator, which the tray opens at run time.
    
      16depends=('alsa-lib' 'cairo' 'gcc-libs' 'gdk-pixbuf2' 'glib2' 'glibc' 'gtk3' 'libayatana-appindicator'
    
      17         'libsoup3' 'openssl' 'vulkan-icd-loader' 'wayland' 'webkit2gtk-4.1')
    
      18optdepends=('gst-plugins-base: audio and video in chats'
    
      19            'gst-plugins-good: audio and video in chats'
    
      20            'xdg-utils: open links in the browser')
    
      21provides=('atomic-chat')
    
      22conflicts=('atomic-chat')
    
      23# The core binaries are Bun-compiled: their program follows the executable, and stripping cuts it off.
    
      24options=('!strip' '!debug')
    
      25# On an upgrade: quit and restart the running app (pacman does not run the deb's postinst).
    
      26install=atomic-chat-bin.install
    
      27
    
      28# The release's deb, the same files the deb and rpm install.
    
      29_base='https://github.com/AtomicBot-ai/Atomic-Chat/releases/download/v2.2.29'
    
      30source_x86_64=("atomic-chat-${_version}-x86_64.deb::${_base}/atomic-chat_${_version}_amd64.deb")
    
      31source_aarch64=("atomic-chat-${_version}-aarch64.deb::${_base}/atomic-chat_${_version}_arm64.deb")
    
      32sha256sums_x86_64=('73c10f37f0010d1f0a1d81cb06b9fdf3486b7af6178a7406c66e6ed0e6506e83')
    
      33sha256sums_aarch64=('1787f74a785d7a3994219f4113b3abff75efc51626b865bf0aca55fed7aec2bc')
    
      34
    
      35package() {
    
      36  bsdtar -xf "${srcdir}/data.tar.zst" -C "${pkgdir}"
    
      37  # Arch keeps licenses under the package's own name.
    
      38  mv "${pkgdir}/usr/share/licenses/atomic-chat" "${pkgdir}/usr/share/licenses/${pkgname}"
    
      39}
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-29 09:52:05	Low	2