bclone-bin

MEDIUM

maintainer taxin 0 votes scanned 2026-09-06 13:11:32.219503

View on AUR

Why flagged

The package downloads prebuilt binaries from a GitHub release (non-whitelisted host) with a SKIP'd checksum for the license file, posing a supply-chain risk if the source were compromised.

Triggered rules

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads prebuilt binaries from a GitHub release (non-whitelisted host) with a SKIP'd checksum for the license file, posing a supply-chain risk if the source were compromised.

PKGBUILD

      1# Maintainer: avscs <avscs@proton.me>
    
      2pkgname=bclone-bin
    
      3pkgver=1.73.3
    
      4pkgrel=1
    
      5pkgdesc="rclone with Alist, Alldebrid, iCloud Photos, Teldrive and Terabox support"
    
      6arch=(x86_64 aarch64 armv7h)
    
      7url="https://github.com/BenjiThatFoxGuy/bclone"
    
      8license=(MIT)
    
      9depends=(glibc)
    
      10optdepends=("fuse3: for rclone mount")
    
      11provides=(rclone bclone)
    
      12conflicts=(rclone bclone)
    
      13source=("https://raw.githubusercontent.com/BenjiThatFoxGuy/bclone/refs/tags/v${pkgver}/COPYING")
    
      14source_aarch64=("${url}/releases/download/v${pkgver}/rclone-v${pkgver}-linux-arm64.zip")
    
      15source_armv7h=("${url}/releases/download/v${pkgver}/rclone-v${pkgver}-linux-arm-v7.zip")
    
      16source_x86_64=("${url}/releases/download/v${pkgver}/rclone-v${pkgver}-linux-amd64.zip")
    
      17sha256sums=("SKIP")
    
      18sha256sums_aarch64=("ec74c86c78edb5f84d230e20d44ec353270b5ba2644ec97fe4c39b4fe1c97b9b")
    
      19sha256sums_armv7h=("06b62f6fc68a00f146fafa2648e28770faa8e0dcc6ce554aa604c19b7ab4a385")
    
      20sha256sums_x86_64=("0d23270f03e546c5e9f4e71304b1202f8a3e989490f619b2a7c514ea817c7cd2")
    
      21
    
      22prepare() {
    
      23	cd $(find . -type d -regex ".*/rclone-v${pkgver}-linux-\(amd64\|arm64\|arm-v7\)")
    
      24
    
      25	./rclone genautocomplete bash rclone.bash_completion
    
      26	./rclone genautocomplete zsh rclone.zsh_completion
    
      27	./rclone genautocomplete fish rclone.fish_completion
    
      28}
    
      29
    
      30package() {
    
      31	cd $(find . -type d -regex ".*/rclone-v${pkgver}-linux-\(amd64\|arm64\|arm-v7\)")
    
      32
    
      33	install -D rclone ${pkgdir}/usr/bin/rclone
    
      34	install -Dm644 rclone.bash_completion "$pkgdir"/usr/share/bash-completion/completions/rclone
    
      35	install -Dm644 rclone.zsh_completion "$pkgdir"/usr/share/zsh/site-functions/_rclone
    
      36	install -Dm644 rclone.fish_completion "$pkgdir"/usr/share/fish/vendor_completions.d/rclone.fish
    
      37	install -Dm644 ../COPYING "$pkgdir"/usr/share/licenses/$pkgname/COPYING
    
      38	install -Dm644 rclone.1 "$pkgdir"/usr/share/man/man1/rclone.1
    
      39	install -d "$pkgdir"/usr/share/doc/$pkgname
    
      40	install -t "$pkgdir"/usr/share/doc/$pkgname -m644 README.html README.txt
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-06 13:11:32	Medium	2
2026-06-18 16:11:54	Clean	0