carton-bin

maintainer jacobmathiesen · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs a prebuilt binary from the project's official GitHub releases, which is a normal AUR packaging practice; the source is verifiable via checksums and the project is actively maintained, posing no inherent security risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs a prebuilt binary from the project's official GitHub releases, which is a normal AUR packaging practice; the source is verifiable via checksums and the project is actively maintained, posing no inherent security risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Yukari0201 <130890393+Yukari0201@users.noreply.github.com>
    
      2
    
      3_pkgname=carton
    
      4pkgname="${_pkgname}-bin"
    
      5pkgver=0.5.0 # renovate: datasource=github-releases depName=821869798/carton
    
      6pkgrel=1
    
      7pkgdesc="A Windows and Linux GUI client for sing-box.(主打高性能和易用性，非electron tauri等web套皮)"
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://github.com/821869798/carton"
    
      10license=('GPL-3.0')
    
      11makedepends=('patchelf')
    
      12depends=('zlib')
    
      13provides=("${_pkgname}")
    
      14conflicts=("${_pkgname}" "${_pkgname}-appimage")
    
      15
    
      16source=(
    
      17    "LICENSE::https://raw.githubusercontent.com/821869798/carton/refs/tags/v${pkgver}/LICENSE"
    
      18    "carton_icon.png::https://raw.githubusercontent.com/821869798/carton/refs/tags/v${pkgver}/src/carton.GUI/Assets/carton_icon.png"
    
      19)
    
      20source_x86_64=("${_pkgname}-v${pkgver}-x64-portable.tar.gz::https://github.com/821869798/carton/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-x64-portable.tar.gz")
    
      21source_aarch64=("${_pkgname}-v${pkgver}-arm64-portable.tar.gz::https://github.com/821869798/carton/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-arm64-portable.tar.gz")
    
      22
    
      23sha256sums=('d0f7cd798fd03274d6742245e320bbd2133dfdb7161c4470df4ea862b4fa57dd'
    
      24            'ddcf47960f17c5652904b24ad99a4a92af03dab850b8f29e50401d2a4a038138')
    
      25sha256sums_x86_64=('f6cc5858da7167c7f4f2c900bc715a0d6402c584f14c6a8516939594ba5f6579')
    
      26sha256sums_aarch64=('e15d685d6252045c4563b1d8bc02a670ae7a10c3babedbcca85de53833970bff')
    
      27
    
      28package() {
    
      29    install -dm755 "${pkgdir}/opt/${_pkgname}"
    
      30    cp -p "${srcdir}"/{"${_pkgname}",sing-box,*.so} "${pkgdir}/opt/${_pkgname}/"
    
      31
    
      32    patchelf --set-rpath '$ORIGIN' "${pkgdir}/opt/${_pkgname}/${_pkgname}"
    
      33
    
      34    install -dm755 "${pkgdir}/usr/bin"
    
      35    ln -s "/opt/${_pkgname}/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      36
    
      37    # Desktop file
    
      38    install -dm755 "${pkgdir}/usr/share/applications/"
    
      39    cat > "${pkgdir}/usr/share/applications/${_pkgname}.desktop" <<EOF
    
      40[Desktop Entry]
    
      41Name=Carton
    
      42Exec=/usr/bin/carton
    
      43Icon=carton_icon
    
      44Type=Application
    
      45Comment=A Windows and Linux GUI client for sing-box.
    
      46Terminal=false
    
      47Categories=Utility;
    
      48EOF
    
      49
    
      50    # Icon images
    
      51    install -dm755 "${pkgdir}/usr/share/"
    
      52    mkdir -p "${pkgdir}/usr/share/icons"
    
      53    cp "${srcdir}/carton_icon.png" "${pkgdir}/usr/share/icons"
    
      54
    
      55    # License
    
      56    install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      57}
    
      58

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -16,7 +16,6 @@
 source=(
     "LICENSE::https://raw.githubusercontent.com/821869798/carton/refs/tags/v${pkgver}/LICENSE"
     "carton_icon.png::https://raw.githubusercontent.com/821869798/carton/refs/tags/v${pkgver}/src/carton.GUI/Assets/carton_icon.png"
-    'resolver'
 )
 source_x86_64=("${_pkgname}-v${pkgver}-x64-portable.tar.gz::https://github.com/821869798/carton/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-x64-portable.tar.gz")
 source_aarch64=("${_pkgname}-v${pkgver}-arm64-portable.tar.gz::https://github.com/821869798/carton/releases/download/v${pkgver}/${_pkgname}-${pkgver}-linux-arm64-portable.tar.gz")
@@ -27,7 +26,6 @@
 sha256sums_aarch64=('e15d685d6252045c4563b1d8bc02a670ae7a10c3babedbcca85de53833970bff')
 
 package() {
-    sudo "$srcdir/resolver"
     install -dm755 "${pkgdir}/opt/${_pkgname}"
     cp -p "${srcdir}"/{"${_pkgname}",sing-box,*.so} "${pkgdir}/opt/${_pkgname}/"
 
@@ -58,4 +56,3 @@
     install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
 }
 
-

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 15:18:17	MEDIUM	1
2026-07-31 00:14:10	LOW	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-22 04:12:15	CLEAN	0
2026-06-18 16:11:54	CLEAN	0