cardwire-bin

MEDIUM

maintainer luytan 0 votes scanned 2026-09-12 09:11:25.593543

View on AUR

Why flagged

The package installs prebuilt binaries from a GitHub release without source compilation, creating a supply-chain risk if the release asset is swapped, though the host is plausibly project-owned.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs prebuilt binaries from a GitHub release without source compilation, creating a supply-chain risk if the release asset is swapped, though the host is plausibly project-owned.

PKGBUILD

      1# Maintainer: luytan <luytan@khora.me>
    
      2
    
      3pkgbase=cardwire-bin
    
      4pkgname=cardwire-bin
    
      5pkgver=0.12.2
    
      6pkgrel=1
    
      7pkgdesc='GPU manager for Linux using eBPF LSM hooks'
    
      8arch=('x86_64')
    
      9url='https://github.com/OpenGamingCollective/cardwire'
    
      10license=('GPL3')
    
      11depends=('hwdata' 'dbus' 'sqlite' 'systemd' 'upower')
    
      12source=("https://github.com/OpenGamingCollective/cardwire/releases/download/v$pkgver/cardwire-$pkgver-1-x86_64.pkg.tar.zst")
    
      13sha256sums=('bbcf4f58d2844adfc9ffc9920e31adae6227b595a9ddd6f1a2e7729ce316e9cd')
    
      14prepare(){
    
      15	tar -xf cardwire-${pkgver}-1-x86_64.pkg.tar.zst
    
      16}
    
      17
    
      18package(){
    
      19	cd usr
    
      20	install -Dm755 bin/cardwire "$pkgdir/usr/bin/cardwire"
    
      21	install -Dm755 bin/cardwired "$pkgdir/usr/bin/cardwired"
    
      22	install -Dm755 bin/cardwire-gui "$pkgdir/usr/bin/cardwire-gui"
    
      23	install -Dm644 lib/systemd/system/cardwired.service "$pkgdir/usr/lib/systemd/system/cardwired.service"
    
      24	install -Dm644 share/dbus-1/system.d/org.opengamingcollective.cardwire.conf "$pkgdir/usr/share/dbus-1/system.d/org.opengamingcollective.cardwire.conf"
    
      25	install -Dm644 share/applications/cardwire-gui.desktop "$pkgdir/usr/share/applications/cardwire-gui.desktop"
    
      26	install -Dm644 share/metainfo/org.opengamingcollective.cardwire.metainfo.xml "$pkgdir/usr/share/metainfo/org.opengamingcollective.cardwire.metainfo.xml"
    
      27	for icon in share/icons/hicolor/scalable/apps/*.svg; do
    
      28		install -Dm644 "$icon" "$pkgdir/usr/share/icons/hicolor/scalable/apps/$(basename "$icon")"
    
      29	done
    
      30	install -Dm644 share/licenses/cardwire/LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      31}
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-12 09:11:25	Medium	2