daily-you-bin

MEDIUM

maintainer Webstas 0 votes scanned 2026-09-17 01:24:19.570146

View on AUR

Why flagged

The package installs a prebuilt binary bundle from a GitHub release without a verifiable checksum (SKIP), creating a supply-chain risk if the source were tampered with or swapped.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary bundle from a GitHub release without a verifiable checksum (SKIP), creating a supply-chain risk if the source were tampered with or swapped.

PKGBUILD

      1# Maintainer: BigWebstas
    
      2#
    
      3# Packages the prebuilt `flutter build linux --release` bundle for Arch.
    
      4# Not source-built: the bundle tarball is downloaded from the GitHub release
    
      5# matching pkgver. CI rewrites pkgver below to match the release tag and
    
      6# drops a matching local tarball so the in-workflow build (which runs before
    
      7# that release exists) skips the network fetch.
    
      8pkgname=daily-you-bin
    
      9pkgver=3.4.3
    
      10pkgrel=1
    
      11pkgdesc="Every day is worth remembering... (mood tracking, journaling)"
    
      12arch=('x86_64')
    
      13url="https://github.com/BigWebstas/Daily_You"
    
      14license=('GPL3')
    
      15provides=('daily-you')
    
      16conflicts=('daily-you')
    
      17depends=('gtk3' 'sqlite')
    
      18source=("daily_you.desktop"
    
      19        "logo.svg"
    
      20        "https://github.com/BigWebstas/Daily_You/releases/download/v$pkgver/DailyYou-$pkgver-linux-x86_64-bundle.tar.gz")
    
      21sha256sums=('5e65fec1284bddbf8b905d5adfc6975e0936429bc416fa86f8d9244ef2148934'
    
      22            '04b9e4925d53e37da78a5cc53945c709f45c7615e232fd67be59efecf236d403'
    
      23            'SKIP')
    
      24
    
      25package() {
    
      26  install -d "$pkgdir/usr/lib/daily_you"
    
      27  cp -r "$srcdir/bundle/"* "$pkgdir/usr/lib/daily_you/"
    
      28
    
      29  install -d "$pkgdir/usr/bin"
    
      30  ln -s /usr/lib/daily_you/daily_you "$pkgdir/usr/bin/daily_you"
    
      31
    
      32  install -Dm644 "$srcdir/daily_you.desktop" "$pkgdir/usr/share/applications/daily_you.desktop"
    
      33  install -Dm644 "$srcdir/logo.svg" "$pkgdir/usr/share/icons/hicolor/scalable/apps/daily_you.svg"
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 01:24:19	Medium	2