bullet-bin

maintainer fahimscirex · 0 votes · scanned 2026-08-18 00:03:42.021799

MEDIUM

Why flagged The package installs a prebuilt binary from a GitHub release, which is an unverifiable executable payload; while GitHub is generally trusted, the lack of source compilation and use of a non-native package (deb) creates a supply-chain risk if the release asset were maliciously replaced.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a GitHub release, which is an unverifiable executable payload; while GitHub is generally trusted, the lack of source compilation and use of a non-native package (deb) creates a supply-chain risk if the release asset were maliciously replaced.

PKGBUILD

      1# Maintainer: Fahim Montasir Misbah <fahimscirex@tutanota.com>
    
      2pkgname=bullet-bin
    
      3_pkgname=bullet
    
      4pkgver=1.3.26
    
      5pkgrel=1
    
      6pkgdesc="The fastest coding agent — desktop app and terminal edition"
    
      7arch=('x86_64')
    
      8url="https://www.codewithbullet.com/"
    
      9license=('LicenseRef-custom')
    
      10depends=(
    
      11  'alsa-lib'
    
      12  'at-spi2-core'
    
      13  'cairo'
    
      14  'dbus'
    
      15  'expat'
    
      16  'gcc-libs'
    
      17  'glibc'
    
      18  'gtk3'
    
      19  'libcups'
    
      20  'libdrm'
    
      21  'libnotify'
    
      22  'libsecret'
    
      23  'libx11'
    
      24  'libxcb'
    
      25  'libxcomposite'
    
      26  'libxdamage'
    
      27  'libxext'
    
      28  'libxfixes'
    
      29  'libxrandr'
    
      30  'libxss'
    
      31  'libxtst'
    
      32  'mesa'
    
      33  'nspr'
    
      34  'nss'
    
      35  'pango'
    
      36  'util-linux-libs'
    
      37  'xdg-utils'
    
      38)
    
      39optdepends=(
    
      40  'libappindicator-gtk3: StatusNotifierItem support'
    
      41)
    
      42options=('!strip')
    
      43source=("https://github.com/trybullet/bullet-releases/releases/download/v${pkgver}/bullet_${pkgver}_amd64.deb")
    
      44sha256sums=('5d0d1f524e6ce1dbaa6030c781bc0ec3170be0758ea20b89b65f67947dd4a454')
    
      45noextract=("bullet_${pkgver}_amd64.deb")
    
      46
    
      47package() {
    
      48  # Extract data archive from the .deb (an ar archive) into pkgdir
    
      49  bsdtar -xf "${srcdir}/bullet_${pkgver}_amd64.deb" -C "${srcdir}" data.tar.xz
    
      50  bsdtar -xf "${srcdir}/data.tar.xz" -C "${pkgdir}"
    
      51
    
      52  # Create symlink to binary in /usr/bin
    
      53  install -d "${pkgdir}/usr/bin"
    
      54  ln -s /opt/Bullet/bullet "${pkgdir}/usr/bin/bullet"
    
      55
    
      56  # Ensure correct permissions for chrome-sandbox
    
      57  if [[ -f "${pkgdir}/opt/Bullet/chrome-sandbox" ]]; then
    
      58    chmod 4755 "${pkgdir}/opt/Bullet/chrome-sandbox"
    
      59  fi
    
      60
    
      61  # Upstream ships no license of its own; install the bundled component
    
      62  # notices so /usr/share/licenses/ is not empty for this custom license.
    
      63  install -Dm644 "${pkgdir}/opt/Bullet/LICENSE.electron.txt" \
    
      64    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
    
      65  install -Dm644 "${pkgdir}/opt/Bullet/LICENSES.chromium.html" \
    
      66    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
    
      67}
    
      68

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	MEDIUM	2
2026-08-17 00:18:29	MEDIUM	2
2026-08-16 00:03:42	MEDIUM	2
2026-08-15 00:26:13	MEDIUM	2
2026-08-14 00:03:41	MEDIUM	2
2026-08-13 11:26:16	MEDIUM	2