balun-bin

LOW

maintainer jmsq 0 votes scanned 2026-09-05 18:00:42.527733

View on AUR

Why flagged

The package installs a precompiled binary from the project's official GitHub releases, which is a normal and expected practice; the source host is not whitelisted but is plausibly legitimate, and the binary is not executed during build/install in a way that enables remote code execution.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a precompiled binary from the project's official GitHub releases, which is a normal and expected practice; the source host is not whitelisted but is plausibly legitimate, and the binary is not executed during build/install in a way that enables remote code execution.

PKGBUILD

      1# Maintainer: John-Michael Mulesa <jmulesa@gmail.com>
    
      2pkgname=balun-bin
    
      3pkgver=0.1.0
    
      4pkgrel=1
    
      5pkgdesc="A lightweight cross-platform HDHomeRun live TV viewer (Pre-compiled Binary)"
    
      6arch=('x86_64')
    
      7url="https://github.com/jm2/balun"
    
      8license=('GPL-3.0-or-later')
    
      9# The release binary is already stripped, so there is no debug info to split out.
    
      10options=('!debug')
    
      11depends=(
    
      12  'glibc'
    
      13  'libgcc'
    
      14  'gtk4>=4.16'
    
      15  'libadwaita>=1.6'
    
      16  'gstreamer>=1.20'
    
      17  'gst-plugins-base-libs'
    
      18  'gst-plugins-good'
    
      19  'gst-plugins-bad-libs'
    
      20  'gst-plugin-gtk4'
    
      21  'gst-libav'
    
      22)
    
      23provides=("balun=${pkgver}")
    
      24conflicts=('balun')
    
      25# Use the official Arch pre-compiled package as the source
    
      26source=("${pkgname}-${pkgver}.pkg.tar.zst::${url}/releases/download/v${pkgver}/balun-${CARCH}.pkg.tar.zst")
    
      27sha256sums=('522650fd095352fe564821fb8a6f0166e9e6831390770ea38688fea6eb845e92')
    
      28
    
      29package() {
    
      30  # The source is a .pkg.tar.zst which makepkg extracts to $srcdir.
    
      31  # Copy its payload (everything under usr/) to $pkgdir.
    
      32  cp -av "$srcdir"/usr "$pkgdir/"
    
      33
    
      34  # Ensure the license directory matches the package name for AUR standards
    
      35  if [ -d "$pkgdir/usr/share/licenses/balun" ]; then
    
      36    mv "$pkgdir/usr/share/licenses/balun" "$pkgdir/usr/share/licenses/$pkgname"
    
      37  fi
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-05 18:00:42	Low	2