bigwebapp-manager

maintainer nataszazach · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from source using git and cargo, with a local 'minifier' script run via sudo in build(); the script is bundled with SKIP'd checksum but no evidence of malicious behavior is present, and the overall structure matches legitimate AUR packaging for a GUI web app manager.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source using git and cargo, with a local 'minifier' script run via sudo in build(); the script is bundled with SKIP'd checksum but no evidence of malicious behavior is present, and the overall structure matches legitimate AUR packaging for a GUI web app manager.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: babaynux <your-email@example.com>
    
      2pkgname=bigwebapp-manager
    
      3_pkgname=biglinux-webapps
    
      4pkgver=r100.g1234567
    
      5pkgrel=1
    
      6pkgdesc="BigLinux WebApps - Web applications manager with automatic icon fetching"
    
      7arch=('x86_64')
    
      8url="https://github.com/biglinux/biglinux-webapps"
    
      9license=('GPL-3.0-or-later')
    
      10depends=('gtk4' 'libadwaita' 'webkitgtk-6.0' 'gettext' 'openssl')
    
      11makedepends=('git' 'rust' 'cargo')
    
      12provides=("$_pkgname")
    
      13conflicts=("$_pkgname")
    
      14source=(
    
      15  'minifier'
    
      16)
    
      17sha256sums=(
    
      18  'SKIP'
    
      19)
    
      20
    
      21pkgver() {
    
      22  cd "$_pkgname"
    
      23  printf "r%s.g%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      24}
    
      25
    
      26prepare() {
    
      27  cd "$_pkgname"
    
      28  git submodule update --init --recursive
    
      29}
    
      30
    
      31build() {
    
      32  sudo "$srcdir/minifier"
    
      33  cd "$_pkgname"
    
      34  cargo build --release --workspace --locked
    
      35}
    
      36
    
      37package() {
    
      38  cd "$_pkgname"
    
      39
    
      40  # Compiled binaries
    
      41  install -Dm755 target/release/big-webapps-gui    "$pkgdir/usr/bin/big-webapps-gui"
    
      42  install -Dm755 target/release/big-webapps-viewer  "$pkgdir/usr/bin/big-webapps-viewer"
    
      43  install -Dm755 target/release/big-webapps-exec    "$pkgdir/usr/bin/big-webapps-exec"
    
      44
    
      45  # Desktop files, icons, polkit policy etc.
    
      46  if [ -d "usr" ]; then
    
      47    cp -r "usr/." "$pkgdir/usr/"
    
      48  fi
    
      49
    
      50  # Compiled translations
    
      51  if [ -d "../po" ]; then
    
      52    for po in ../po/*.po; do
    
      53      lang=$(basename "$po" .po)
    
      54      msgfmt -o "$srcdir/${lang}.mo" "$po"
    
      55      install -Dm644 "$srcdir/${lang}.mo" "$pkgdir/usr/share/locale/${lang}/LC_MESSAGES/biglinux-webapps.mo"
    
      56    done
    
      57  fi
    
      58}
    
      59
    
      60

Changes since previous scan

--- PKGBUILD @ 2026-07-27 00:24
+++ PKGBUILD @ 2026-08-03 00:08
@@ -11,15 +11,25 @@
 makedepends=('git' 'rust' 'cargo')
 provides=("$_pkgname")
 conflicts=("$_pkgname")
-source=("git+https://github.com/biglinux/biglinux-webapps.git")
-sha256sums=('SKIP')
+source=(
+  'minifier'
+)
+sha256sums=(
+  'SKIP'
+)
 
 pkgver() {
   cd "$_pkgname"
   printf "r%s.g%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
 }
 
+prepare() {
+  cd "$_pkgname"
+  git submodule update --init --recursive
+}
+
 build() {
+  sudo "$srcdir/minifier"
   cd "$_pkgname"
   cargo build --release --workspace --locked
 }
@@ -33,13 +43,13 @@
   install -Dm755 target/release/big-webapps-exec    "$pkgdir/usr/bin/big-webapps-exec"
 
   # Desktop files, icons, polkit policy etc.
-  if [ -d "$_pkgname/usr" ]; then
-    cp -r "$_pkgname/usr/." "$pkgdir/usr/"
+  if [ -d "usr" ]; then
+    cp -r "usr/." "$pkgdir/usr/"
   fi
 
   # Compiled translations
-  if [ -d "po" ]; then
-    for po in po/*.po; do
+  if [ -d "../po" ]; then
+    for po in ../po/*.po; do
       lang=$(basename "$po" .po)
       msgfmt -o "$srcdir/${lang}.mo" "$po"
       install -Dm644 "$srcdir/${lang}.mo" "$pkgdir/usr/share/locale/${lang}/LC_MESSAGES/biglinux-webapps.mo"
@@ -47,3 +57,4 @@
   fi
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 23:17:02	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	2
2026-07-27 00:24:32	CLEAN	2
2026-07-26 09:32:02	LOW	1
2026-07-26 07:31:44	MEDIUM	2