datazen-bin

MEDIUM

maintainer jinzhongjia 0 votes scanned 2026-09-03 03:52:21.844053

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release without source availability, creating a supply-chain risk despite the otherwise legitimate project context.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a GitHub release without source availability, creating a supply-chain risk despite the otherwise legitimate project context.

PKGBUILD

      1# Maintainer: jinzhongjia <mail@nvimer.org>
    
      2
    
      3pkgname=datazen-bin
    
      4pkgver=0.1.1
    
      5pkgrel=1
    
      6pkgdesc="Lightweight, open-source AI database client"
    
      7arch=('x86_64')
    
      8url="https://github.com/flyxl/datazen"
    
      9license=('GPL-3.0-or-later')
    
      10depends=(
    
      11    'cairo'
    
      12    'dbus'
    
      13    'gdk-pixbuf2'
    
      14    'glib2'
    
      15    'glibc'
    
      16    'gtk3'
    
      17    'hicolor-icon-theme'
    
      18    'libayatana-appindicator'
    
      19    'libgcc'
    
      20    'libsoup3'
    
      21    'webkit2gtk-4.1'
    
      22)
    
      23provides=('datazen')
    
      24conflicts=('datazen')
    
      25options=('!strip' '!debug')
    
      26
    
      27_relurl="${url}/releases/download/v${pkgver}"
    
      28source=(
    
      29    "${pkgname}-${pkgver}.deb::${_relurl}/DataZen_${pkgver}_amd64-linux-x64.deb"
    
      30    "LICENSE-${pkgver}::https://raw.githubusercontent.com/flyxl/datazen/v${pkgver}/LICENSE"
    
      31)
    
      32noextract=("${pkgname}-${pkgver}.deb")
    
      33sha256sums=(
    
      34    '620ec53e1095400a957802af9990ff16f0f3227728b325644c774ccd2dff777a'
    
      35    '3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986'
    
      36)
    
      37
    
      38prepare() {
    
      39    rm -rf "${srcdir}/debroot"
    
      40    mkdir -p "${srcdir}/debroot"
    
      41
    
      42    # The release .deb is an ar archive whose payload is data.tar.gz.
    
      43    bsdtar -xOf "${srcdir}/${pkgname}-${pkgver}.deb" data.tar.gz \
    
      44        | bsdtar -xf - -C "${srcdir}/debroot"
    
      45}
    
      46
    
      47package() {
    
      48    cd "${srcdir}/debroot"
    
      49
    
      50    cp -a usr/. "${pkgdir}/usr/"
    
      51
    
      52    # Upstream leaves Categories empty, which hides the app from categorized
    
      53    # desktop menus. Keep the vendor entry otherwise unchanged.
    
      54    sed -i 's/^Categories=.*/Categories=Development;Database;/' \
    
      55        "${pkgdir}/usr/share/applications/DataZen.desktop"
    
      56
    
      57    install -Dm644 "${srcdir}/LICENSE-${pkgver}" \
    
      58        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      59}
    
      60

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-03 03:52:21	Medium	2