codenomad-tauri-bin

MEDIUM

maintainer aardbol 0 votes scanned 2026-08-24 15:23:42.374088

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release without source build, using an unverifiable .deb file; while the host is plausible, the lack of checksum verification on the download introduces a supply-chain risk if the source were swapped.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a GitHub release without source build, using an unverifiable .deb file; while the host is plausible, the lack of checksum verification on the download introduces a supply-chain risk if the source were swapped.

PKGBUILD

      1# Maintainer: @aardbol
    
      2pkgname=codenomad-tauri-bin
    
      3pkgver=0.19.0
    
      4pkgrel=2
    
      5pkgdesc='The AI Coding Cockpit for OpenCode (Tauri-based)'
    
      6arch=('x86_64')
    
      7url='https://github.com/NeuralNomadsAI/CodeNomad'
    
      8license=('MIT')
    
      9depends=(
    
      10  'glibc'
    
      11  'gtk3'
    
      12  'webkit2gtk-4.1'
    
      13)
    
      14optdepends=(
    
      15  'libayatana-appindicator: tray icon support'
    
      16  'xdg-desktop-portal: desktop integration'
    
      17  'opencode: the open source coding agent'
    
      18)
    
      19provides=('codenomad')
    
      20conflicts=('codenomad' 'codenomad-git' 'codenomad-bin')
    
      21options=('!debug' '!strip')
    
      22
    
      23source_x86_64=("${pkgname}-${pkgver}.deb::${url}/releases/download/v${pkgver}/CodeNomad-Tauri-linux-x64-${pkgver}.deb")
    
      24
    
      25sha256sums_x86_64=('81e197cea79248f0025c14387802cd678a98d110900696c660714014b2629bfb')
    
      26
    
      27package() {
    
      28  # Extract the data payload from the deb (ar archive containing data.tar.gz).
    
      29  bsdtar -xf "${pkgname}-${pkgver}.deb" -C "$srcdir" data.tar.gz
    
      30  bsdtar -xf "$srcdir/data.tar.gz" -C "$pkgdir"
    
      31}
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-24 15:23:42	Medium	2