cutwire-drift-bin

MEDIUM

maintainer MapleProjects 0 votes scanned 2026-10-06 00:13:36.889724

View on AUR

Why flagged

The package repackages a prebuilt binary from GitHub releases without verifying its build process, creating a supply-chain risk if the upstream binary is compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package repackages a prebuilt binary from GitHub releases without verifying its build process, creating a supply-chain risk if the upstream binary is compromised.

PKGBUILD

      1# Maintainer: Maple <maple@localhost>
    
      2pkgname=cutwire-drift-bin
    
      3pkgver=0.7.0
    
      4pkgrel=3
    
      5pkgdesc="Beginner-friendly open-source video editor built with Qt 6, QML and FFmpeg (prebuilt binary)"
    
      6arch=('x86_64')
    
      7url="https://github.com/CutWire-Studios/Drift"
    
      8license=('GPL-3.0-or-later')
    
      9provides=('drift')
    
      10options=('!strip' '!debug')
    
      11depends=(
    
      12    'qt6-base' 'qt6-declarative' 'qt6-svg' 'qt6-multimedia' 'qt6-multimedia-ffmpeg'
    
      13    'qt6-imageformats'
    
      14    'ffmpeg' 'zstd' 'openssl' 'soundtouch' 'zlib'
    
      15    'harfbuzz' 'icu' 'expat' 'libpng' 'fontconfig' 'freetype2'
    
      16)
    
      17# El upstream publica un paquete de pacman completo en releases; solo se reempaqueta.
    
      18# El pkgrel del artefacto upstream es siempre "-1" y no sigue al pkgrel de este paquete,
    
      19# por eso se usa una variable aparte: cambiar pkgrel aqui no debe romper la URL.
    
      20# El alias NO puede llamarse igual al paquete resultante ($pkgname-$pkgver-$pkgrel-$arch):
    
      21# makepkg lo veria como "ya construido", saltaria package() y pacman instalaria el archivo
    
      22# fuente, que trae pkgname=drift en su .PKGINFO y choca con este paquete.
    
      23_upstream_pkgrel=1
    
      24source=("drift-upstream-$pkgver-$_upstream_pkgrel-$arch.pkg.tar.zst::https://github.com/CutWire-Studios/Drift/releases/download/v$pkgver/drift-$pkgver-$_upstream_pkgrel-$arch.pkg.tar.zst")
    
      25sha256sums=('dc7f3c15db9008f29a96a9d69ba966ee1b07fb9abdba43658331c3e91ec18954')
    
      26
    
      27package() {
    
      28    bsdtar -xf "$srcdir/drift-upstream-$pkgver-$_upstream_pkgrel-$arch.pkg.tar.zst" \
    
      29        --exclude '.PKGINFO' --exclude '.MTREE' --exclude '.BUILDINFO' \
    
      30        -C "$pkgdir"
    
      31
    
      32    # El upstream usa "drift" como dirname de licencia; se renombra al de este paquete.
    
      33    if [[ -d "$pkgdir/usr/share/licenses/drift" ]]; then
    
      34        install -d "$pkgdir/usr/share/licenses/$pkgname"
    
      35        mv "$pkgdir/usr/share/licenses/drift/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/"
    
      36        rmdir "$pkgdir/usr/share/licenses/drift"
    
      37    fi
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 00:13:36	Medium	2
2026-10-05 23:40:58	Low	1