colibri-social-beta-bin

MEDIUM

maintainer fereira 0 votes scanned 2026-11-02 00:26:00.633185

View on AUR

Why flagged

The package downloads a prebuilt .deb from GitHub releases, which is an unverifiable binary executable; while the host is plausible, the lack of source build and SKIP'd checksum on the license file reduce verifiability, creating a supply-chain risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The package downloads a prebuilt .deb from GitHub releases, which is an unverifiable binary executable; while the host is plausible, the lack of source build and SKIP'd checksum on the license file reduce verifiability, creating a supply-chain risk.

PKGBUILD

      1# Maintainer: Eli Fereira <eli@fereira.net>
    
      2
    
      3pkgname=colibri-social-beta-bin
    
      4pkgver=0.6.0_spaces.19
    
      5pkgrel=1
    
      6pkgdesc="Call, chat, and hang out on a platform built for you! (spaces version)"
    
      7url="https://github.com/colibri-social/colibri.social"
    
      8_rawurl="${url/github.com/raw.githubusercontent.com}/refs/tags/v${pkgver//_/-}"
    
      9arch=('x86_64')
    
      10license=('MIT')
    
      11conflicts=(
    
      12  'colibri-social'
    
      13  'colibri-social-beta'
    
      14)
    
      15depends=(
    
      16  'webkit2gtk-4.1'
    
      17  'gtk3'
    
      18  'libsoup3'
    
      19  'cairo'
    
      20  'glib2'
    
      21  'gdk-pixbuf2'
    
      22  'hicolor-icon-theme'
    
      23  'nspr'
    
      24  'nss'
    
      25  'alsa-lib'
    
      26)
    
      27makedepends=(
    
      28  'nodejs'
    
      29  'pnpm'
    
      30  'rust'
    
      31  'cargo'
    
      32)
    
      33source=(
    
      34  "${pkgname}-${pkgver//_/-}.tar.gz::${url}/releases/download/v${pkgver//_/-}/Colibri.Social_${pkgver//_/-}_amd64.deb"
    
      35  "LICENSE_$pkgver::$_rawurl/LICENSE"
    
      36)
    
      37sha256sums=(
    
      38  'e93cdd5a8346b66e6071daa06a785fd558a9c046cec7879d141efc4d86e0a527'
    
      39  'SKIP'
    
      40)
    
      41
    
      42prepare() {
    
      43  tar -xf data.tar.*
    
      44}
    
      45
    
      46package() {
    
      47  install -Dm644 "LICENSE_$pkgver" "${pkgdir}/usr/share/licenses/$pkgname/LICENSE"
    
      48  cp -a "${srcdir}/usr" "${pkgdir}/"
    
      49
    
      50  # Disable autoupdates
    
      51  sed -i 's/Exec=colibri-social/Exec=colibri-social --no-update-check/' "${pkgdir}/usr/share/applications/Colibri Social.desktop"
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-02 00:26:00	Medium	2
2026-11-02 00:02:06	Medium	2