clarion-bin

MEDIUM

maintainer illusory 0 votes scanned 2026-10-17 09:17:40.511065

View on AUR

Why flagged

The package installs a prebuilt binary from a forked repository's GitHub release with an unverified checksum (SKIP), creating a supply-chain risk if the release artifact were tampered with or substituted.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The package installs a prebuilt binary from a forked repository's GitHub release with an unverified checksum (SKIP), creating a supply-chain risk if the release artifact were tampered with or substituted.

PKGBUILD

      1# Maintainer: Become-ILLUSORY <becomeillusory@gmail.com>
    
      2#
    
      3# ── 上游源码仓库 / upstream source ────────────────────────────────────────────
    
      4#   https://github.com/123llyrr/clarion
    
      5#
    
      6# 本包提供 CachyOS x86-64-v3 工具链预编译的二进制（原生 AVX2/FMA/BMI2）。
    
      7# 构建流水线 / build pipeline:
    
      8#   https://github.com/Become-ILLUSORY/clarion/blob/feat/arch-v3-build/.github/workflows/build-v3.yml
    
      9# 打包脚本 / packaging scripts:
    
      10#   https://github.com/Become-ILLUSORY/clarion/tree/feat/arch-v3-build/packaging/arch
    
      11# ─────────────────────────────────────────────────────────────────────────────
    
      12
    
      13pkgname=clarion-bin
    
      14pkgver=0.1.0
    
      15pkgrel=1
    
      16pkgdesc='Modern Wayland compositor with a native Vulkan backend and an independent desktop core (x86-64-v3 build)'
    
      17arch=('x86_64' 'x86_64_v3')
    
      18url='https://github.com/123llyrr/clarion'
    
      19license=('GPL-3.0-or-later')
    
      20
    
      21# 二进制产物来自本 fork 的 Actions（上游仓库未发布预编译包）。
    
      22_repo='Become-ILLUSORY/clarion'
    
      23
    
      24depends=(
    
      25  'cairo'
    
      26  'gcc-libs'
    
      27  'glib2'
    
      28  'glibc'
    
      29  'libdisplay-info'
    
      30  'libglvnd'
    
      31  'libinput'
    
      32  'libpipewire'
    
      33  'libxkbcommon'
    
      34  'mesa'
    
      35  'pango'
    
      36  'pixman'
    
      37  'seatd'
    
      38  'systemd-libs'
    
      39  'vulkan-icd-loader'
    
      40  'wayland'
    
      41)
    
      42optdepends=(
    
      43  'xwayland-satellite: run X11 applications'
    
      44  'xdg-desktop-portal-gtk: fallback portal implementation'
    
      45  'xdg-desktop-portal-gnome: screencasting support'
    
      46  'gnome-keyring: Secret portal provider'
    
      47  'mako: notification daemon'
    
      48  'alacritty: terminal bound in the default configuration'
    
      49  'fuzzel: launcher bound in the default configuration'
    
      50)
    
      51provides=('clarion')
    
      52conflicts=('clarion' 'clarion-git')
    
      53replaces=('clarion')
    
      54
    
      55# 上游要求在用户未安装 debuginfo 时也能给出可读的 panic 回溯，故不 strip。
    
      56options=('!strip' '!debug')
    
      57
    
      58_archive="clarion-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst"
    
      59
    
      60# 下载的本身就是完整的 Arch 软件包；makepkg 会把它自动解压到 $srcdir，
    
      61# 这里必须显式禁止。
    
      62noextract=("${_archive}")
    
      63
    
      64source=("${_archive}::https://github.com/${_repo}/releases/download/v${pkgver}/${_archive}")
    
      65sha256sums=('SKIP')
    
      66
    
      67prepare() {
    
      68  # 二进制按 x86-64-v3 编译（AVX2/FMA/BMI2）。在这里明确报错，
    
      69  # 好过运行到第一帧时收到 SIGILL。
    
      70  local flags feature
    
      71  flags=$(grep -m1 '^flags' /proc/cpuinfo)
    
      72  for feature in avx2 fma bmi1 bmi2 movbe; do
    
      73    if [[ $flags != *" $feature "* ]]; then
    
      74      error "clarion-bin 需要支持 x86-64-v3 的 CPU（缺少: ${feature}）。"
    
      75      error '请改用源码构建，或在支持 AVX2 的机器上重新打包。'
    
      76      return 1
    
      77    fi
    
      78  done
    
      79}
    
      80
    
      81package() {
    
      82  # 归档即成品包，跳过它自带的元数据，只取文件树。
    
      83  bsdtar -xf "${srcdir}/${_archive}" -C "${pkgdir}" \
    
      84    --exclude .PKGINFO --exclude .MTREE --exclude .BUILDINFO
    
      85}
    
      86

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 09:17:40	Medium	2