clara-bin

MEDIUM

maintainer acropolis 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package installs a prebuilt binary from a non-official release host (GitHub personal fork) with an unverifiable checksum (SKIP), creating a supply-chain risk if the binary were tampered with.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The package installs a prebuilt binary from a non-official release host (GitHub personal fork) with an unverifiable checksum (SKIP), creating a supply-chain risk if the binary were tampered with.

PKGBUILD

      1# Maintainer: acroarch
    
      2# Contributor: falkTX <falktx@falktx.com>
    
      3
    
      4pkgname=clara-bin
    
      5pkgver=1.0.1
    
      6pkgrel=1
    
      7pkgdesc="Audio Plugin Host (fork with UI/UX enhancements, modal tools, dynamic cable gradients, and session safety - binary release)"
    
      8arch=('x86_64')
    
      9url="https://github.com/acropolis914/Clara"
    
      10license=('GPL-2.0-or-later')
    
      11depends=(
    
      12  'alsa-lib'
    
      13  'glibc'
    
      14  'hicolor-icon-theme'
    
      15  'libglvnd'
    
      16  'libx11'
    
      17  'libxcursor'
    
      18  'libxrandr'
    
      19  'qt6-wayland'
    
      20  'wayland'
    
      21  'python-rich'
    
      22  'python-pyqt6'
    
      23  'sdl2'
    
      24  'qt6-base'
    
      25  'qt6-svg'
    
      26  'fluidsynth'
    
      27  'liblo'
    
      28  'file'
    
      29  'libsndfile'
    
      30  'ttf-nerd-fonts-symbols'
    
      31)
    
      32optdepends=(
    
      33  'jack: for using carla/clara with JACK'
    
      34  'lv2-host: for the LV2 plugin'
    
      35  'vst-host: for the VST plugin'
    
      36  'python-pyliblo: OSC control support'
    
      37  'python-rdflib: LADSPA-RDF support'
    
      38)
    
      39provides=('carla' 'carla-git' 'clara' 'clara-git' 'clap-host' 'dssi-host' 'ladspa-host' 'lv2-host' 'vst3-host' 'vst-host')
    
      40conflicts=('carla' 'carla-git' 'clara' 'clara-git')
    
      41source=("https://github.com/acropolis914/Clara/releases/download/v${pkgver}/clara-archlinux-${pkgver}.tar.zst")
    
      42sha256sums=('SKIP')
    
      43
    
      44package() {
    
      45  cp -dr --no-preserve=ownership "$srcdir/usr" "$pkgdir/"
    
      46}
    
      47

Changes since previous scan

--- PKGBUILD @ 2026-10-15 00:28
+++ PKGBUILD @ 2026-10-17 00:21
@@ -2,7 +2,7 @@
 # Contributor: falkTX <falktx@falktx.com>
 
 pkgname=clara-bin
-pkgver=0.1.3
+pkgver=1.0.1
 pkgrel=1
 pkgdesc="Audio Plugin Host (fork with UI/UX enhancements, modal tools, dynamic cable gradients, and session safety - binary release)"
 arch=('x86_64')

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 09:11:05	Medium	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 15:17:00	Low	2
2026-10-13 13:16:52	Low	2