daintree-bin

MEDIUM

maintainer zxp19821005 0 votes scanned 2026-11-06 08:13:39.601626

View on AUR

Why flagged

Installs a prebuilt binary .deb from updates.daintree.org (a non-GitHub, project-controlled update server rather than official release infrastructure like GitHub releases), which is a swappable host for unverified executables; checksums are present but the host could silently serve different binaries, and the package has few votes and was recently uploaded.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 "${pkgname%-bin}-${pkgver}.deb::https://updates.daintree.org/releases/${pkgname%-bin}_${pkgver}_amd64.deb"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs a prebuilt binary .deb from updates.daintree.org (a non-GitHub, project-controlled update server rather than official release infrastructure like GitHub releases), which is a swappable host for unverified executables; checksums are present but the host could silently serve different binaries, and the package has few votes and was recently uploaded.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=daintree-bin
    
      3_pkgname=Daintree
    
      4pkgver=0.48.0
    
      5_electronversion=42
    
      6pkgrel=1
    
      7pkgdesc="A review-first desktop habitat for running AI coding agents in parallel."
    
      8arch=('x86_64')
    
      9url="https://daintree.org"
    
      10_ghurl="https://github.com/daintreehq/daintree"
    
      11license=('Apache-2.0')
    
      12conflicts=("${pkgname%-bin}")
    
      13provides=("${pkgname%-bin}=${pkgver}")
    
      14depends=(
    
      15	"electron${_electronversion}"
    
      16    'git'
    
      17    'npm'
    
      18    'nodejs'
    
      19    'github-cli'
    
      20)
    
      21source=(
    
      22    "${pkgname%-bin}-${pkgver}.deb::https://updates.daintree.org/releases/${pkgname%-bin}_${pkgver}_amd64.deb"
    
      23	"${pkgname%-bin}.js"
    
      24	"${pkgname%-bin}.sh"
    
      25)
    
      26sha256sums=('1a0a96323876a27490123fc1d1b756c30a06626d751d02833d70e1923196d738'
    
      27            '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
    
      28            'ace275e253744ca62d2572776df26b947f3c89616239985003126db635fc300e')
    
      29_get_app_dir() {
    
      30	find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
    
      31		| while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
    
      32}
    
      33_check_electron_version() {
    
      34	local _v=$(strings "$(find "$(_get_app_dir)" -maxdepth 1 -type f \
    
      35		-executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)" \
    
      36		| grep -oP 'Electron/\K[0-9]+' | head -1)
    
      37	[[ -z "$_v" ]] && { echo -e "\033[1;33mNote: Could not check version.\033[0m"; return; }
    
      38	(( _v == _electronversion )) && c=32 || c=31
    
      39	echo -e "Electron version: \033[1;${c}m$_v$([[ $c -eq 31 ]] && echo " (expected $_electronversion)")\033[0m"
    
      40}
    
      41_install_icons() {
    
      42	local _src="${1:-${srcdir}}" _name="${pkgname%-bin}" _icon _ext _size _dest
    
      43	while IFS= read -r -d '' _icon; do
    
      44		_ext="${_icon##*.}"
    
      45		_size=$(echo "${_icon%/*}" | grep -oE '[0-9]+x[0-9]+|scalable' | head -1)
    
      46		[[ -z "${_size}" ]] && _size=$([[ "${_ext}" == svg ]] && echo scalable || od -An -tu1 -j16 -N8 "${_icon}" 2>/dev/null | awk '{printf "%dx%d",$1*16777216+$2*65536+$3*256+$4,$5*16777216+$6*65536+$7*256+$8}')
    
      47		[[ "${_size}" =~ ^[0-9]+x[0-9]+$ ]] || _size=scalable
    
      48		_dest=$([[ "${_icon}" == */share/pixmaps/* ]] && echo pixmaps || echo "icons/hicolor/${_size}/apps")
    
      49		install -Dm644 "${_icon}" "${pkgdir}/usr/share/${_dest}/${_name}.${_ext}"
    
      50	done < <(find "${_src}" \( -path '*/share/icons/*' -o -path '*/share/pixmaps/*' -o -path '*entries/icons/*' \) -type f \( -name '*.png' -o -name '*.svg' \) -print0 2>/dev/null)
    
      51}
    
      52prepare() {
    
      53	sed -i -e "
    
      54		s/@electronversion@/${_electronversion}/g
    
      55		s/@appname@/${pkgname%-bin}/g
    
      56	" "${srcdir}/${pkgname%-bin}.sh" "${srcdir}/${pkgname%-bin}.js"
    
      57	bsdtar -xf "${srcdir}/data."*
    
      58	_check_electron_version
    
      59	sed -i "s/\/opt\/${_pkgname}\///g" "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop"
    
      60}
    
      61package() {
    
      62	install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      63	install -Dm644 "${srcdir}/${pkgname%-bin}.js" -t "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      64	cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-bin}/"
    
      65	_install_icons
    
      66	install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
    
      67    install -Dm644 "${srcdir}/usr/share/mime/packages/${pkgname%-bin}.xml" -t "${pkgdir}/usr/share/mime/packages"
    
      68}
    
      69

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-06 08:13:39	Medium	3
2026-11-06 08:11:27	Medium	3