bdinfo-rs-gui-bin

maintainer agentjp · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt binary from a non-whitelisted host (GitHub releases), which presents a supply-chain risk if the source were silently swapped, despite valid checksums.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt binary from a non-whitelisted host (GitHub releases), which presents a supply-chain risk if the source were silently swapped, despite valid checksums.

PKGBUILD

      1# Maintainer: agentjp <agent at fastmail dot jp>
    
      2# SPDX-License-Identifier: 0BSD (this PKGBUILD; the packaged software is LGPL-2.1-or-later)
    
      3#
    
      4# Template for the AUR `bdinfo-rs-gui-bin` package. The `gui-publish.yml` aur leg
    
      5# replaces 2.0.0 / dbfe110c908388e4cb8f2e8acfe4d106edb269a348955afde9edcbe502db84b5 / 28b64ab4e089fa2fbc4d5264af0f337ae1ad64bf1e60a145d6d1b35711b1549c from the release's
    
      6# verified SHA256SUMS, validates the result in an Arch container (`makepkg
    
      7# --printsrcinfo` + `--verifysource`), and KSXGitHub/github-actions-deploy-aur
    
      8# pushes it to the AUR. Repackages the prebuilt release `.deb`: the gui-v*
    
      9# release ships no Linux tarball, and the `.deb` already lays out the desktop
    
      10# file, metainfo, and icon set at their installed paths.
    
      11pkgname=bdinfo-rs-gui-bin
    
      12_pkgname=bdinfo-rs-gui
    
      13# The AppStream component id, which names the installed desktop file, metainfo
    
      14# file, and icons inside the .deb.
    
      15_appid=io.github.agentjp.bdinfo-rs
    
      16pkgver=2.0.0
    
      17pkgrel=1
    
      18pkgdesc='Native desktop GUI for bdinfo-rs, the memory-safe Blu-ray disc analyzer'
    
      19arch=('x86_64' 'aarch64')
    
      20url='https://github.com/agentjp/bdinfo-rs'
    
      21license=('LGPL-2.1-or-later')
    
      22# The libraries the release binary links dynamically (built on glibc 2.35);
    
      23# everything GPU/dialog-adjacent is loaded at runtime instead — see optdepends.
    
      24depends=('gcc-libs' 'fontconfig' 'freetype2' 'libx11' 'libxkbcommon' 'wayland')
    
      25optdepends=('vulkan-icd-loader: GPU rendering via wgpu; without it the app falls back to its built-in tiny-skia software renderer'
    
      26            'vulkan-driver: a Vulkan implementation for the GPU in use'
    
      27            'xdg-desktop-portal: native file-open dialogs (with a desktop portal backend, e.g. xdg-desktop-portal-gtk)')
    
      28provides=('bdinfo-rs-gui')
    
      29conflicts=('bdinfo-rs-gui')
    
      30# The release binary is prebuilt and already stripped (cargo profile
    
      31# strip=true) — don't re-strip it, and don't emit an (empty) -debug package on
    
      32# hosts whose makepkg.conf enables the `debug` option.
    
      33options=('!strip' '!debug')
    
      34source_x86_64=("${_pkgname}-${pkgver}-x86_64.deb::${url}/releases/download/gui-v${pkgver}/${_pkgname}-x86_64-unknown-linux-gnu.deb")
    
      35source_aarch64=("${_pkgname}-${pkgver}-aarch64.deb::${url}/releases/download/gui-v${pkgver}/${_pkgname}-aarch64-unknown-linux-gnu.deb")
    
      36sha256sums_x86_64=('dbfe110c908388e4cb8f2e8acfe4d106edb269a348955afde9edcbe502db84b5')
    
      37sha256sums_aarch64=('28b64ab4e089fa2fbc4d5264af0f337ae1ad64bf1e60a145d6d1b35711b1549c')
    
      38
    
      39# No .install file: pacman's desktop-file-utils and hicolor-icon-theme hooks
    
      40# refresh the desktop database and icon cache on install/remove; calling those
    
      41# tools from a package function is against the Arch packaging guidelines.
    
      42
    
      43package() {
    
      44    # makepkg has already unpacked the outer .deb (an ar archive bsdtar
    
      45    # recognizes) into $srcdir; unpack the payload tar it contains.
    
      46    tar -xf "${srcdir}"/data.tar.* -C "${srcdir}"
    
      47
    
      48    install -Dm755 "${srcdir}/usr/bin/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      49    install -Dm644 "${srcdir}/usr/share/applications/${_appid}.desktop" \
    
      50        "${pkgdir}/usr/share/applications/${_appid}.desktop"
    
      51    install -Dm644 "${srcdir}/usr/share/metainfo/${_appid}.metainfo.xml" \
    
      52        "${pkgdir}/usr/share/metainfo/${_appid}.metainfo.xml"
    
      53    local size
    
      54    for size in 16 24 32 48 64 128 256 512; do
    
      55        install -Dm644 "${srcdir}/usr/share/icons/hicolor/${size}x${size}/apps/${_appid}.png" \
    
      56            "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/${_appid}.png"
    
      57    done
    
      58    # The .deb's DEP-5 copyright doubles as the license document.
    
      59    install -Dm644 "${srcdir}/usr/share/doc/${_pkgname}/copyright" \
    
      60        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      61}
    
      62

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 21:14:52	MEDIUM	2