clustercut-bin

maintainer keithvassallo · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package repackages an official .deb from the project's GitHub releases, which is a normal practice for AUR; the low severity is due to few votes and recent upload, not malicious content.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package repackages an official .deb from the project's GitHub releases, which is a normal practice for AUR; the low severity is due to few votes and recent upload, not malicious content.

PKGBUILD

      1# Maintainer: Keith Vassallo <keith@vassallo.cloud>
    
      2#
    
      3# Template. `just aur` / `just aur-publish` render this into a real PKGBUILD,
    
      4# substituting 0.4.3 and 9806534349ea78b69e51a0d7649616c7711eacd4aa395b39ce0916c6d4eb3a23 from the published GitHub release.
    
      5# Edit this file, never the generated one.
    
      6#
    
      7# This repackages the official amd64 .deb rather than building from source, so
    
      8# it inherits the binary, the .desktop file and both icons (including the
    
      9# hicolor status tray icon the app looks up by name) with nothing to keep in
    
      10# sync by hand. The `clustercut://` scheme is registered by the app at runtime,
    
      11# so no MimeType wiring is needed here.
    
      12pkgname=clustercut-bin
    
      13pkgver=0.4.3
    
      14pkgrel=1
    
      15pkgdesc="Cross-platform clipboard sync between your devices"
    
      16arch=('x86_64')
    
      17url="https://github.com/keithvassallomt/ClusterCut"
    
      18license=('GPL-3.0-or-later')
    
      19# webkit2gtk-4.1 and gtk3 are linked directly (libwebkit2gtk-4.1.so.0,
    
      20# libjavascriptcoregtk-4.1.so.0, libgtk-3.so.0). libayatana-appindicator is
    
      21# dlopen'd at runtime for the tray icon — not in NEEDED, but the tray is not
    
      22# optional for this app, so it stays a hard dependency.
    
      23depends=('webkit2gtk-4.1' 'gtk3' 'libayatana-appindicator' 'hicolor-icon-theme')
    
      24provides=("clustercut=${pkgver}")
    
      25conflicts=('clustercut')
    
      26options=('!strip' '!debug')
    
      27source=("ClusterCut_${pkgver}_amd64.deb::${url}/releases/download/v${pkgver}/ClusterCut_${pkgver}_amd64.deb")
    
      28sha256sums=('9806534349ea78b69e51a0d7649616c7711eacd4aa395b39ce0916c6d4eb3a23')
    
      29
    
      30package() {
    
      31    # Match data.tar.* by glob so a future bundler switching gzip for xz/zst
    
      32    # keeps working; the inner bsdtar auto-detects the compression.
    
      33    bsdtar -O -xf "ClusterCut_${pkgver}_amd64.deb" 'data.tar.*' | bsdtar -C "${pkgdir}" -xf -
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 07:20:18	LOW	2