conservation-daemon-bin

maintainer notherealmarco · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt binary from the project's own Git repository release page, which is a plausible and expected source for a binary-only release; the host is not whitelisted but is owned by the maintainer and used consistently for the project, and the binary is installed directly without obfuscation or remote code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from the project's own Git repository release page, which is a plausible and expected source for a binary-only release; the host is not whitelisted but is owned by the maintainer and used consistently for the project, and the binary is installed directly without obfuscation or remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source_x86_64=("${pkgname}_${pkgver}_x86_64.tar.gz::https://git.marcorealacci.me/marcorealacci/conservation-daemon/releases/download/v${pkgver}/conservation-daemon_${pkgver}_linux_amd64.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# This file was generated by GoReleaser. DO NOT EDIT.
    
      2# Maintainer: Marco Realacci <marco@marcorealacci.me>
    
      3
    
      4pkgname='conservation-daemon-bin'
    
      5pkgver=0.2.3
    
      6pkgrel=1
    
      7pkgdesc='Battery conservation mode daemon for Lenovo Yoga/IdeaPad'
    
      8url='https://git.marcorealacci.me/marcorealacci/conservation-daemon'
    
      9arch=('x86_64')
    
      10license=('MIT')
    
      11provides=('conservation-daemon' 'conservationd' 'conservationctl' 'conservation-tray')
    
      12conflicts=('conservation-daemon')
    
      13depends=('upower' 'gtk3' 'libayatana-appindicator' 'zenity')
    
      14install=conservation-daemon.install
    
      15
    
      16source_x86_64=("${pkgname}_${pkgver}_x86_64.tar.gz::https://git.marcorealacci.me/marcorealacci/conservation-daemon/releases/download/v${pkgver}/conservation-daemon_${pkgver}_linux_amd64.tar.gz")
    
      17sha256sums_x86_64=('bf4918ba9e6a1ae290d18c5dec3e256b0438e1be65d077517ec8378456e735d1')
    
      18
    
      19package() {
    
      20  install -Dm755 "./conservationd" "${pkgdir}/usr/bin/conservationd"
    
      21  install -Dm755 "./conservationctl" "${pkgdir}/usr/bin/conservationctl"
    
      22  install -Dm755 "./conservation-tray" "${pkgdir}/usr/bin/conservation-tray"
    
      23  # System-level daemon service
    
      24  install -d "${pkgdir}/usr/lib/systemd/system"
    
      25  printf '%s\n' \
    
      26  '[Unit]' \
    
      27  'Description=Battery Conservation Mode Daemon (Lenovo Yoga/IdeaPad)' \
    
      28  'After=network.target dbus.service upower.service' \
    
      29  'Wants=upower.service' \
    
      30  '' \
    
      31  '[Service]' \
    
      32  'Type=simple' \
    
      33  'ExecStart=/usr/bin/conservationd' \
    
      34  'Restart=on-failure' \
    
      35  'RestartSec=5s' \
    
      36  'RuntimeDirectory=conservationd' \
    
      37  'StateDirectory=conservationd' \
    
      38  'Group=conservationd' \
    
      39  'RuntimeDirectoryMode=0770' \
    
      40  'StateDirectoryMode=0755' \
    
      41  '' \
    
      42  '[Install]' \
    
      43  'WantedBy=multi-user.target' \
    
      44  > "${pkgdir}/usr/lib/systemd/system/conservationd.service"
    
      45  # User-level tray service
    
      46  install -d "${pkgdir}/usr/lib/systemd/user"
    
      47  printf '%s\n' \
    
      48  '[Unit]' \
    
      49  'Description=Battery Conservation Tray Icon' \
    
      50  'After=graphical-session.target' \
    
      51  'PartOf=graphical-session.target' \
    
      52  '' \
    
      53  '[Service]' \
    
      54  'Type=simple' \
    
      55  'ExecStart=/usr/bin/conservation-tray' \
    
      56  'Restart=on-failure' \
    
      57  'RestartSec=5s' \
    
      58  '' \
    
      59  '[Install]' \
    
      60  'WantedBy=graphical-session.target' \
    
      61  > "${pkgdir}/usr/lib/systemd/user/conservation-tray.service"
    
      62}
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2