context-bin

maintainer timmo001 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt binary from a non-whitelisted but project-owned release host (GitHub), which presents a supply-chain risk if the source were swapped, though the binary is from the project's official repository.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a non-whitelisted but project-owned release host (GitHub), which presents a supply-chain risk if the source were swapped, though the binary is from the project's official repository.

PKGBUILD

      1#!/bin/sh
    
      2# Maintainer: Aidan Timson (Timmo) <aidan@timmo.dev>
    
      3pkgname=context-bin
    
      4pkgver=20260722.0
    
      5pkgrel=1
    
      6pkgdesc="Standalone CLI and MCP server for deterministic repository context (prebuilt binary)"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://github.com/timmo001/context"
    
      9license=('Apache-2.0')
    
      10keywords=('mcp' 'cli' 'context' 'git' 'agent')
    
      11depends=('glibc')
    
      12provides=('context')
    
      13conflicts=('context' 'context-git')
    
      14options=('!strip')
    
      15source=('context.bash' 'context.fish' '_context' 'LICENSE')
    
      16source_x86_64=("context-${pkgver}-linux-${CARCH}.tar.gz::$url/releases/download/${pkgver}/context-${pkgver}-linux-${CARCH}.tar.gz")
    
      17source_aarch64=("context-${pkgver}-linux-${CARCH}.tar.gz::$url/releases/download/${pkgver}/context-${pkgver}-linux-${CARCH}.tar.gz")
    
      18sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP')
    
      19sha256sums_x86_64=('88d53842da25f736fa4413c8ff7af0731b636c6155b702c3357e7afaf2d079c2')
    
      20sha256sums_aarch64=('e5cd77045530ec66085dbda35f927875dcd3836ac8012df3163ea670a2bae85e')
    
      21
    
      22package() {
    
      23  install -Dm755 context "$pkgdir/usr/bin/context"
    
      24  install -Dm644 context.bash "$pkgdir/usr/share/bash-completion/completions/context"
    
      25  install -Dm644 context.fish "$pkgdir/usr/share/fish/vendor_completions.d/context.fish"
    
      26  install -Dm644 _context "$pkgdir/usr/share/zsh/site-functions/_context"
    
      27  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 17:21:24	MEDIUM	2