bclone

maintainer taxin · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs prebuilt rclone binaries from a non-official GitHub repository without verifiable source code, creating a supply-chain risk if the release assets were tampered with.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs prebuilt rclone binaries from a non-official GitHub repository without verifiable source code, creating a supply-chain risk if the release assets were tampered with.

PKGBUILD

      1# Maintainer: taxin <unknowbrofrombd@duck.com>
    
      2pkgname=bclone
    
      3pkgver=1.74.0
    
      4pkgrel=1
    
      5pkgdesc="rclone with Alist, Alldebrid, iCloud Photos, Teldrive and Terabox support"
    
      6arch=(x86_64 aarch64 armv7h)
    
      7url="https://github.com/BenjiThatFoxGuy/bclone"
    
      8license=(MIT)
    
      9depends=(glibc)
    
      10optdepends=("fuse3: for rclone mount")
    
      11provides=(rclone)
    
      12conflicts=(rclone bclone-bin bclone-git)
    
      13replaces=(bclone-bin bclone-git rclone)
    
      14source=("https://raw.githubusercontent.com/BenjiThatFoxGuy/bclone/refs/tags/v${pkgver}/COPYING")
    
      15source_aarch64=("${url}/releases/download/v${pkgver}/rclone-v${pkgver}-linux-arm64.zip")
    
      16source_armv7h=("${url}/releases/download/v${pkgver}/rclone-v${pkgver}-linux-arm-v7.zip")
    
      17source_x86_64=("${url}/releases/download/v${pkgver}/rclone-v${pkgver}-linux-amd64.zip")
    
      18sha256sums=("SKIP")
    
      19sha256sums_aarch64=("e8b3b69259f477df62203ac23736951e5030849bf72c48a4842c0f4b76ad662a")
    
      20sha256sums_armv7h=("d43fab74c3d02b468c8b2881429e930a5e78d352ab3b1408d365405affca7732")
    
      21sha256sums_x86_64=("effb4071349a92309bc240b16bdc7077758fe51a2ba538055ce1e29844a72a90")
    
      22
    
      23prepare() {
    
      24	cd $(find . -type d -regex ".*/rclone-v${pkgver}-linux-\(amd64\|arm64\|arm-v7\)")
    
      25	./rclone genautocomplete bash rclone.bash_completion
    
      26	./rclone genautocomplete zsh rclone.zsh_completion
    
      27	./rclone genautocomplete fish rclone.fish_completion
    
      28}
    
      29
    
      30package() {
    
      31	cd $(find . -type d -regex ".*/rclone-v${pkgver}-linux-\(amd64\|arm64\|arm-v7\)")
    
      32	install -D rclone ${pkgdir}/usr/bin/rclone
    
      33	install -Dm644 rclone.bash_completion "$pkgdir"/usr/share/bash-completion/completions/rclone
    
      34	install -Dm644 rclone.zsh_completion "$pkgdir"/usr/share/zsh/site-functions/_rclone
    
      35	install -Dm644 rclone.fish_completion "$pkgdir"/usr/share/fish/vendor_completions.d/rclone.fish
    
      36	install -Dm644 ../COPYING "$pkgdir"/usr/share/licenses/$pkgname/COPYING
    
      37	install -Dm644 rclone.1 "$pkgdir"/usr/share/man/man1/rclone.1
    
      38	install -d "$pkgdir"/usr/share/doc/$pkgname
    
      39	install -t "$pkgdir"/usr/share/doc/$pkgname -m644 README.html README.txt
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 13:29:48	MEDIUM	2