cannelloni-bin

LOW

maintainer pineappletoad 0 votes scanned 2026-09-04 05:56:41.774165

View on AUR

Why flagged

The package installs precompiled binaries from a GitHub release by a third party, but the sources are verifiable via checksums and hosted on a trusted platform; no obfuscated code or remote execution occurs, limiting risk to supply-chain trust in the binary maintainer.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs precompiled binaries from a GitHub release by a third party, but the sources are verifiable via checksums and hosted on a trusted platform; no obfuscated code or remote execution occurs, limiting risk to supply-chain trust in the binary maintainer.

PKGBUILD

      1# Maintainer: pineappletoad
    
      2
    
      3pkgname=cannelloni-bin
    
      4pkgver=2.1.2
    
      5_pkgrel_src=1
    
      6pkgrel=1
    
      7pkgdesc="cannelloni is written in C++11 and uses UDP, TCP or SCTP to transfer CAN frames between two machines. (precompiled)"
    
      8arch=('x86_64' 'armv7h')
    
      9url="https://github.com/mguentner/cannelloni"
    
      10license=('GPL-2.0-only')
    
      11options=('!debug')
    
      12provides=('cannelloni')
    
      13conflicts=('cannelloni')
    
      14# armv7h is cross-compiled with -DSCTP_SUPPORT=OFF (no ARM-cross build of
    
      15# lksctp-tools available), so it doesn't need or link against it - UDP/TCP
    
      16# transport, cannelloni's primary use case, is unaffected.
    
      17depends_x86_64=('libgcc_s.so' 'libstdc++.so' 'lksctp-tools')
    
      18depends_armv7h=('libgcc_s.so' 'libstdc++.so')
    
      19
    
      20# x86_64: a full pacman package built natively (via aur-bin-chicken), re-extracted.
    
      21# armv7h: a plain tarball of a cross-compiled install tree (arm-linux-gnueabihf-*-bin
    
      22# toolchain, built in CI on an x86_64 runner) - no native build happens on armv7h
    
      23# at all, this is purely a repackaging step there too.
    
      24source_x86_64=("https://github.com/tubbywrestler/cannelloni-bin/releases/download/${pkgver}-${_pkgrel_src}/cannelloni-${pkgver}-${_pkgrel_src}-x86_64.pkg.tar.zst")
    
      25sha256sums_x86_64=('83ada766cb104111d1732241c65da35c36f74f47cc850113c8fb456246a2109c')
    
      26source_armv7h=("https://github.com/tubbywrestler/cannelloni-bin/releases/download/${pkgver}-${_pkgrel_src}/cannelloni-${pkgver}-${_pkgrel_src}-armv7h.tar.zst")
    
      27sha256sums_armv7h=('109358f62c413b9fc8f6ff227848de5bc8cc2f65e6a663f80c8fbdcd6620317a')
    
      28
    
      29package() {
    
      30    if [ "${CARCH}" = "armv7h" ]; then
    
      31        cp -a "${srcdir}/usr" "${pkgdir}/"
    
      32    else
    
      33        bsdtar -xf "${srcdir}/cannelloni-${pkgver}-${_pkgrel_src}-x86_64.pkg.tar.zst" -C "${pkgdir}" --exclude .PKGINFO --exclude .BUILDINFO --exclude .MTREE
    
      34    fi
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-04 05:56:41	Low	2