colortxt-bin

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt AppImage from the project's official GitHub releases, which is a normal distribution method; the AppImage is extracted and installed locally, but no remote code execution or obfuscation is present, and the source is verifiable via checksums.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 90%): The package downloads a prebuilt AppImage from the project's official GitHub releases, which is a normal distribution method; the AppImage is extracted and installed locally, but no remote code execution or obfuscation is present, and the source is verifiable via checksums.

PKGBUILD

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=colortxt-bin
    
      3_pkgname=ColorTxt
    
      4pkgver=3.2.1
    
      5_electronversion=35
    
      6pkgrel=1
    
      7pkgdesc="A local TXT novel reader that will color the content, bringing you a different reading experience!一款会给内容上色的本地 TXT 小说阅读器，带给你不一样的阅读体验(Prebuilt version.Use system-wide electron)"
    
      8arch=(
    
      9    'aarch64'
    
      10    'x86_64'
    
      11)
    
      12url="https://github.com/ssnangua/ColorTxt"
    
      13license=('MPL-2.0')
    
      14provides=("${pkgname%-bin}=${pkgver}")
    
      15conflicts=("${pkgname%-bin}")
    
      16depends=(
    
      17    "electron${_electronversion}"
    
      18)
    
      19source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.AppImage::${url}/releases/download/v${pkgver}/${pkgname%-bin}-${pkgver}-arm64.AppImage")
    
      20source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.AppImage::${url}/releases/download/v${pkgver}/${pkgname%-bin}-${pkgver}-x86_64.AppImage")
    
      21source=(
    
      22    "LICENSE-${pkgver}::https://raw.githubusercontent.com/ssnangua/ColorTxt/v${pkgver}/LICENSE"
    
      23    "${pkgname%-bin}.sh"
    
      24)
    
      25sha256sums=('3f3d9e0024b1921b067d6f7f88deb4a60cbe7a78e76c64e3f1d7fc3b779b9d04'
    
      26            'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
    
      27sha256sums_aarch64=('09bbee0ae15c62aeae6a491f8453702bedfcc654c0303df4bf29b07b5f53dddd')
    
      28sha256sums_x86_64=('e6bdaf5d98d680b495f1c275b3214b077236695288c67873100e3e928c08c3af')
    
      29_get_app_dir() {
    
      30    find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
    
      31}
    
      32_check_electron_version() {
    
      33    echo "Verifying Electron version..."
    
      34    local _main_exe=$(find "$(_get_app_dir)" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)
    
      35    [[ -z "${_main_exe}" ]] && echo -e "\033[1;33mNote: Could not find Electron binary.\033[0m" && return
    
      36    local _elec_ver=$(strings "${_main_exe}" | grep -oP 'Electron/\K[0-9]+' | head -1)
    
      37    [[ -z "${_elec_ver}" ]] && echo -e "\033[1;33mNote: Could not determine Electron version.\033[0m" && return
    
      38    [[ "${_elec_ver}" != "${_electronversion}" ]] &&
    
      39        echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m" ||
    
      40        echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
    
      41}
    
      42prepare() {
    
      43    sed -i -e "
    
      44        s/@electronversion@/${_electronversion}/g
    
      45        s/@appname@/${pkgname%-bin}/g
    
      46        s/@runname@/app.asar/g
    
      47        s/@cfgdirname@/${pkgname%-bin}/g
    
      48    " "${srcdir}/${pkgname%-bin}.sh"
    
      49    if [ ! -x "${srcdir}/${pkgname%-bin}-${pkgver}-${CARCH}.AppImage" ];then
    
      50        chmod +x "${srcdir}/${pkgname%-bin}-${pkgver}-${CARCH}.AppImage"
    
      51    fi
    
      52    if [ -d "${srcdir}/squashfs-root" ];then
    
      53        rm -rf "${srcdir}/squashfs-root"
    
      54    fi
    
      55    "${srcdir}/${pkgname%-bin}-${pkgver}-${CARCH}.AppImage" --appimage-extract > /dev/null
    
      56    _check_electron_version
    
      57    local _app_dir=$(_get_app_dir)
    
      58    sed -i "s/AppRun --no-sandbox/${pkgname%-bin}/g" "${_app_dir}/${pkgname%-bin}.desktop"
    
      59    find "${_app_dir}/resources" -type d -perm 700 -exec chmod 755 {} +
    
      60}
    
      61package() {
    
      62    install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      63    install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      64	local _app_dir=$(_get_app_dir)
    
      65	cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname%-bin}/"
    
      66    install -Dm644 "${_app_dir}/usr/lib/"* -t "${pkgdir}/usr/lib/${pkgname%-bin}/lib"
    
      67    find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
    
      68        _extension="${_i##*.}"
    
      69        _icon_path="${_i#*share/icons/}"
    
      70        _target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
    
      71        install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
    
      72    done
    
      73    install -Dm644 "${_app_dir}/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
    
      74    install -Dm644 "${srcdir}/LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      75}
    
      76

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
 pkgname=colortxt-bin
 _pkgname=ColorTxt
-pkgver=3.2.0
+pkgver=3.2.1
 _electronversion=35
 pkgrel=1
 pkgdesc="A local TXT novel reader that will color the content, bringing you a different reading experience!一款会给内容上色的本地 TXT 小说阅读器，带给你不一样的阅读体验(Prebuilt version.Use system-wide electron)"
@@ -24,8 +24,8 @@
 )
 sha256sums=('3f3d9e0024b1921b067d6f7f88deb4a60cbe7a78e76c64e3f1d7fc3b779b9d04'
             'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
-sha256sums_aarch64=('cf51f8b257a99b9c706719efc1a6ffe659f48cd10d2979f02c15d289469d1426')
-sha256sums_x86_64=('7180606ab605ae204250a28bb6647d2342f58f9bfe43c26cb53b6ea1b13de98e')
+sha256sums_aarch64=('09bbee0ae15c62aeae6a491f8453702bedfcc654c0303df4bf29b07b5f53dddd')
+sha256sums_x86_64=('e6bdaf5d98d680b495f1c275b3214b077236695288c67873100e3e928c08c3af')
 _get_app_dir() {
     find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
 }

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 03:17:12	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 09:14:07	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 03:37:00	LOW	2