auto-subs-bin

MEDIUM

maintainer rafaeloledo 0 votes scanned 2026-09-17 09:25:44.114158

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release without source compilation, creating a supply-chain risk if the release artifact were compromised, though it comes from the project's official repository.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a GitHub release without source compilation, creating a supply-chain risk if the release artifact were compromised, though it comes from the project's official repository.

PKGBUILD

      1# Maintainer: rafaeloledo <rafaeloliveiraledo@gmail.com>
    
      2
    
      3pkgname=auto-subs-bin
    
      4pkgver=3.9.0
    
      5pkgrel=1
    
      6pkgdesc="On-device subtitle generation for DaVinci Resolve, Premiere, and After Effects"
    
      7arch=('x86_64')
    
      8url="https://github.com/tmoroney/auto-subs"
    
      9license=('MIT')
    
      10options=('!debug')
    
      11depends=(
    
      12  'ffmpeg'
    
      13  'gtk3'
    
      14  'webkit2gtk-4.1'
    
      15)
    
      16optdepends=(
    
      17  'davinci-resolve: Fusion script integration'
    
      18)
    
      19source=("https://github.com/tmoroney/auto-subs/releases/download/v${pkgver}/AutoSubs-linux-x86_64.deb")
    
      20sha256sums=('773481bf992fdb8521981727ea54fce0e39ce6ad9d3eccae9bbeaa6f479e0430')
    
      21
    
      22package() {
    
      23  cd "$srcdir"
    
      24  bsdtar -xf AutoSubs-linux-x86_64.deb
    
      25  bsdtar -xf data.tar.* -C "$pkgdir"
    
      26}
    
      27

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 09:25:44	Medium	2