darkly-art-bin

MEDIUM

maintainer nyefan 0 votes scanned 2026-10-06 00:13:36.889724

View on AUR

Why flagged

The package downloads a prebuilt Debian binary from GitHub Releases without source availability, creating an unverifiable supply-chain risk despite the otherwise legitimate project context.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package downloads a prebuilt Debian binary from GitHub Releases without source availability, creating an unverifiable supply-chain risk despite the otherwise legitimate project context.

PKGBUILD

      1# Maintainer: Nyefan <archuserrepository at nyefan dot org>
    
      2
    
      3pkgname="darkly-art-bin"
    
      4pkgver="0.10.0"
    
      5pkgrel="1"
    
      6pkgdesc="Forbidden Editor for Artists"
    
      7arch=("x86_64")
    
      8url="https://github.com/darkly-art/darkly"
    
      9license=("AGPL-3.0-or-later")
    
      10options=("!strip" "!debug")
    
      11depends=(
    
      12  "glibc" "libgcc"
    
      13  "gtk3" "glib2" "pango" "cairo" "at-spi2-core"
    
      14  "nss" "nspr"
    
      15  "alsa-lib" "libcups" "dbus" "expat" "systemd-libs"
    
      16  "mesa" "libglvnd"
    
      17  "libx11" "libxcb" "libxcomposite" "libxdamage" "libxext" "libxfixes" "libxrandr" "libxkbcommon"
    
      18  "libnotify" "xdg-utils"
    
      19)
    
      20optdepends=(
    
      21  "libpulse: PulseAudio/PipeWire audio output"
    
      22  "libsecret: secure credential storage"
    
      23  "gnome-keyring: secret service backend for libsecret"
    
      24  "kwallet: secret service backend for libsecret (KDE)"
    
      25  "kde-cli-tools: file deletion support (kioclient)"
    
      26  "trash-cli: file deletion support (trash-put)"
    
      27  "libva: hardware video decoding"
    
      28  "gtk4: --gtk-version=4 support"
    
      29  "lsb-release: distribution detection"
    
      30)
    
      31
    
      32provides=("darkly-art=${pkgver}")
    
      33conflicts=("darkly-art")
    
      34source=("${pkgname}-v${pkgver}.deb::https://github.com/darkly-art/darkly/releases/download/v${pkgver}/darkly-desktop_${pkgver}_amd64.deb")
    
      35sha256sums=("c74ec6621ed3e6323c5c9d7fc0b612f58d46e336af0a9dde200b0e9255f90c87")
    
      36
    
      37prepare() {
    
      38  pushd "${srcdir}" >/dev/null
    
      39    mkdir "root"
    
      40    bsdtar -xf data.tar.* -C "root"
    
      41    pushd "root" >/dev/null
    
      42      mkdir -p "opt"
    
      43      mv "usr/lib/darkly-desktop" "opt/darkly-desktop"
    
      44      ln -sf "/opt/darkly-desktop/darkly" "usr/bin/darkly-desktop"
    
      45      rmdir "usr/lib"
    
      46      rm -r "usr/share/lintian"
    
      47    popd >/dev/null
    
      48  popd >/dev/null
    
      49}
    
      50
    
      51package() {
    
      52  cp -a "${srcdir}/root/." "${pkgdir}/"
    
      53}
    
      54
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 00:13:36	Medium	2
2026-10-05 23:40:58	Low	1