chan-desktop-bin

LOW

maintainer fiorix 0 votes scanned 2026-11-03 12:04:35.126831

View on AUR

Why flagged

The package downloads a prebuilt binary from a GitHub release, which is a common and generally acceptable practice for AUR packages; the source is verifiable and tied to a specific version, reducing risk despite the untrusted host flag.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt binary from a GitHub release, which is a common and generally acceptable practice for AUR packages; the source is verifiable and tied to a specific version, reducing risk despite the untrusted host flag.

PKGBUILD

      1# Maintainer: Alexandre Fiori <fiorix@gmail.com>
    
      2#
    
      3# Versionless template. packaging/distros/arch/make-aur-package.sh renders the
    
      4# release version, pkgrel, and the asset's checksum into the AUR metadata, and
    
      5# refuses a source URL that does not expand to the asset name
    
      6# packaging/distros/arch/desktop-bin-asset.sh gives.
    
      7#
    
      8# The release asset is the file tree of the chan-desktop package, built from
    
      9# the same tag by the chan-desktop recipe on an Arch Linux Archive snapshot
    
      10# that trails the release by six weeks. A binary linked against older glibc
    
      11# and WebKitGTK keeps running on newer ones, so the snapshot sets the oldest
    
      12# system this package runs on, including derivatives whose mirrors trail Arch.
    
      13
    
      14pkgname=chan-desktop-bin
    
      15pkgver=0.123.0
    
      16pkgrel=1
    
      17pkgdesc='Supercharged terminal emulator, desktop app (prebuilt)'
    
      18arch=('x86_64')
    
      19url='https://chan.app'
    
      20license=('Apache-2.0')
    
      21# The same runtime set as the chan-desktop recipe the binary comes from;
    
      22# scripts/check-build-matrix.py holds the two lists equal.
    
      23depends=(
    
      24    'gcc-libs'
    
      25    'glibc'
    
      26    'gtk3'
    
      27    'hicolor-icon-theme'
    
      28    'libayatana-appindicator'
    
      29    'librsvg'
    
      30    'libsoup3'
    
      31    'systemd'
    
      32    'webkit2gtk-4.1'
    
      33    'xdg-utils'
    
      34)
    
      35provides=("chan=$pkgver" "chan-desktop=$pkgver")
    
      36conflicts=('chan' 'chan-desktop')
    
      37# makepkg already stripped the binary and split its debug symbols out when it
    
      38# built the chan-desktop package.
    
      39options=(!strip !debug)
    
      40# arch=() admits only x86_64, so makepkg refuses any other $CARCH before the
    
      41# URL is used.
    
      42source=("https://github.com/fiorix/chan/releases/download/v$pkgver/chan-desktop-bin-$pkgver-$pkgrel-$CARCH.tar.zst")
    
      43sha256sums=('34333d513a16a2dc8e37f8970c0292766062effc8809bf77474be87ba6080c99')
    
      44
    
      45package() {
    
      46    cp -a usr "$pkgdir/"
    
      47}
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-03 12:04:35	Low	2