cordial-bin

LOW

maintainer taxin 0 votes scanned 2026-09-13 09:14:07.132728

View on AUR

Why flagged

The package downloads a prebuilt Arch Linux package from the project's official GitHub releases and repackages it without modification, which is a normal practice for -bin packages; the source is trustworthy and no unreviewed remote code execution occurs.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt Arch Linux package from the project's official GitHub releases and repackages it without modification, which is a normal practice for -bin packages; the source is trustworthy and no unreviewed remote code execution occurs.

PKGBUILD

      1# Maintainer: taxin <taxin@users.noreply.github.com>
    
      2#
    
      3# Prebuilt counterpart to packaging/aur/cordial/PKGBUILD. Where cordial (and
    
      4# cordial-git) build the Rust workspace with cargo, this package downloads the
    
      5# .pkg.tar.zst that upstream CI attaches to the GitHub release -- itself the
    
      6# output of `makepkg` against packaging/aur/cordial/PKGBUILD on the same tag --
    
      7# and repacks it untouched. No compilation, so arch lives with that artifact.
    
      8#
    
      9# The release asset name embeds the `git describe` build id
    
      10# (0.14.0.r0.g2f623e2 in this case), so a release bump touches both $pkgver
    
      11# and the pinned URL below. Regenerate the checksum with `sha256sum` on the
    
      12# downloaded file.
    
      13
    
      14pkgname=cordial-bin
    
      15pkgver=0.14.0
    
      16pkgrel=1
    
      17pkgdesc="Roblox's official Android build, run natively on Linux -- Cordial ships no Roblox code and fetches a signature-verified one (prebuilt)"
    
      18arch=('x86_64')
    
      19url="https://github.com/luohoa97/cordial"
    
      20license=('GPL-3.0-or-later')
    
      21depends=(
    
      22  'gtk4'
    
      23  'libadwaita'
    
      24  'webkitgtk-6.0'
    
      25  'zlib'
    
      26  'glib2'
    
      27  'pango'
    
      28  'graphene'
    
      29  'libsoup3'
    
      30  'libgcc'
    
      31  'libstdc++'
    
      32  'glibc'
    
      33  'vulkan-icd-loader'
    
      34  'wayland'
    
      35  'libxkbcommon'
    
      36  'libglvnd'
    
      37  'pipewire'
    
      38  'hicolor-icon-theme'
    
      39  'deno'
    
      40)
    
      41conflicts=('cordial' 'cordial-git')
    
      42install="$pkgname.install"
    
      43# The binaries in the artifact were already stripped by CI's own makepkg;
    
      44# stripping them again fails and would not make them byte-identical.
    
      45options=('!strip' '!debug')
    
      46source=("cordial.pkg.tar.zst::https://github.com/luohoa97/cordial/releases/download/v$pkgver/cordial-0.14.0.r0.g2f623e2-1-x86_64.pkg.tar.zst")
    
      47sha256sums=('c3b0e337432cd239ad2d7e13db1ef91346971451865b6b93ea8d4d9b8b020b7b')
    
      48
    
      49package() {
    
      50  bsdtar -xf "$srcdir/cordial.pkg.tar.zst" -C "$pkgdir"
    
      51  # The artifact is itself a pacman package; makepkg regenerates these as the
    
      52  # cordial-bin package's own instead of letting them leak through.
    
      53  rm -f "$pkgdir"/.BUILDINFO "$pkgdir"/.INSTALL "$pkgdir"/.MTREE "$pkgdir"/.PKGINFO
    
      54}

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-13 09:14:07	Low	2