cinnabar-bin

LOW

maintainer EinfxchFinn 1 votes scanned 2026-10-30 13:56:02.430493

View on AUR

Why flagged

The package downloads a prebuilt AppImage from the project's official GitHub releases, which is then extracted and installed; while the source is not built locally, it comes from a trusted project host and the checksums are provided, limiting supply-chain risk to low.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt AppImage from the project's official GitHub releases, which is then extracted and installed; while the source is not built locally, it comes from a trusted project host and the checksums are provided, limiting supply-chain risk to low.

PKGBUILD

      1# Maintainer: Finn Künstner <finn dot kuenstner at gmail dot com>
    
      2
    
      3_pkgname=cinnabar
    
      4pkgname=$_pkgname-bin
    
      5pkgver=0.1.31
    
      6pkgrel=1
    
      7pkgdesc='Unofficial client compatible with Minecraft: Bedrock Edition, written in Rust'
    
      8arch=('x86_64')
    
      9url='https://github.com/cinnabar-mc/cinnabar'
    
      10license=('PolyForm-Noncommercial-1.0.0')
    
      11depends=(
    
      12  'alsa-lib'
    
      13  'bash'
    
      14  'glibc'
    
      15  'hicolor-icon-theme'
    
      16  'libgcc'
    
      17  'libglvnd'
    
      18  'libx11'
    
      19  'libxcursor'
    
      20  'libxi'
    
      21  'libxkbcommon'
    
      22  'libxkbcommon-x11'
    
      23  'systemd-libs'
    
      24  'vulkan-driver'
    
      25  'vulkan-icd-loader'
    
      26  'wayland'
    
      27)
    
      28optdepends=(
    
      29  'kdialog: file picker and dialogs without an XDG portal'
    
      30  'pipewire-alsa: sound on PipeWire'
    
      31  'pulseaudio-alsa: sound on PulseAudio'
    
      32  'xdg-utils: open links and accept Discord invites'
    
      33  'zenity: file picker and dialogs without an XDG portal'
    
      34)
    
      35provides=("$_pkgname=$pkgver")
    
      36conflicts=("$_pkgname")
    
      37options=('!debug' '!strip')
    
      38_appimage=$_pkgname-$pkgver-x86_64.AppImage
    
      39source=("$_appimage::$url/releases/download/v$pkgver/Cinnabar-x86_64.AppImage"
    
      40        "$_pkgname.sh")
    
      41sha256sums=('ffddee0f190678106d2689ef8a52f6dfa07c3c62c3eb2ff1a2e18fd4ab27336f'
    
      42            '7c5357b45eb23687940ebfdafce0c27b163a4c6a986a03bb757a272c3bd796a3')
    
      43
    
      44prepare() {
    
      45  rm -rf squashfs-root
    
      46  chmod +x "$_appimage"
    
      47  "./$_appimage" --appimage-extract >/dev/null
    
      48}
    
      49
    
      50package() {
    
      51  cd squashfs-root
    
      52
    
      53  install -d "$pkgdir/opt/$_pkgname"
    
      54  cp -r usr/bin usr/share "$pkgdir/opt/$_pkgname/"
    
      55
    
      56  install -Dm755 "$srcdir/$_pkgname.sh" "$pkgdir/usr/bin/$_pkgname"
    
      57  install -Dm644 "$_pkgname.desktop" -t "$pkgdir/usr/share/applications"
    
      58  install -Dm644 "$_pkgname.png" -t "$pkgdir/usr/share/icons/hicolor/256x256/apps"
    
      59
    
      60  install -Dm644 "usr/share/$_pkgname/licenses/Cinnabar-LICENSE.md" \
    
      61    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      62  install -Dm644 "usr/share/$_pkgname/assets/THIRD_PARTY_NOTICES.md" \
    
      63    -t "$pkgdir/usr/share/licenses/$pkgname"
    
      64}
    
      65

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-30 13:56:02	Low	2