dbar-bin

LOW

maintainer dusanb 1 votes scanned 2026-09-14 17:17:35.691721

View on AUR

Why flagged

The package downloads a prebuilt binary from the project's official GitHub releases, which is a normal practice for -bin packages; the source code is available and the binary is from a trusted project host, so the risk is low despite the static rule flag for few votes and recent upload.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt binary from the project's official GitHub releases, which is a normal practice for -bin packages; the source code is available and the binary is from a trusted project host, so the risk is low despite the static rule flag for few votes and recent upload.

PKGBUILD

      1# Maintainer: Dusan Borovcanin <borovcanindusan1@gmail.com>
    
      2
    
      3# The binary the Release workflow builds, repackaged. `dbar` builds the same
    
      4# tag from source for anyone who would rather compile it themselves.
    
      5#
    
      6# pkgver and sha256sums are rewritten by scripts/aur-publish.sh when a tag is
    
      7# released, so the copy in the repository always describes a real release
    
      8# rather than a placeholder nobody can install.
    
      9
    
      10pkgname=dbar-bin
    
      11_pkgname=dbar
    
      12pkgver=0.6.0
    
      13pkgrel=1
    
      14pkgdesc="A small, event-driven Wayland status bar for Sway and SwayFX (prebuilt)"
    
      15# The Release workflow publishes one binary, and it is x86-64.
    
      16arch=('x86_64')
    
      17url="https://github.com/dborovcanin/dbar"
    
      18license=('Apache-2.0')
    
      19# Exactly what readelf -d records, and no more: libpipewire-0.3.so, libgcc_s.so
    
      20# and libc. `gcc-libs` would name the same libgcc_s through a metapackage that
    
      21# also drags in libasan, libtsan, libobjc and libgfortran, none of which dbar
    
      22# links against.
    
      23depends=('glibc' 'libgcc' 'libpipewire')
    
      24optdepends=(
    
      25  'noto-fonts: the default font family and the Latin fallback'
    
      26  'noto-fonts-emoji: colour emoji in window titles and track names'
    
      27  'noto-fonts-cjk: Chinese, Japanese and Korean window titles'
    
      28  'ttf-nerd-fonts-symbols: Nerd Font glyphs in workspace names'
    
      29  'sway: the compositor dbar reads workspaces and window titles from'
    
      30)
    
      31# The release profile already strips, so makepkg has nothing to take out and
    
      32# no symbols to split into a debug package.
    
      33options=('!strip' '!debug')
    
      34provides=("dbar=$pkgver")
    
      35conflicts=('dbar' 'dbar-git')
    
      36# The tag archive comes along for the licence, the README and the examples:
    
      37# the release asset is the binary on its own.
    
      38source=("$_pkgname-$pkgver-linux-x86_64::$url/releases/download/v$pkgver/dbar-linux-x86_64"
    
      39        "$_pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
    
      40sha256sums=('54ba04249ea6edcd5d3463e8d80eb92e752b7650288780b07497aacc19b9aa49'
    
      41            '8645398ba8ae209a77d6c89dbf7a71791997fd36a2567d299a584a85fb24be0f')
    
      42
    
      43package() {
    
      44  install -Dm755 "$srcdir/$_pkgname-$pkgver-linux-x86_64" "$pkgdir/usr/bin/$_pkgname"
    
      45
    
      46  cd "$_pkgname-$pkgver"
    
      47  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$_pkgname/LICENSE"
    
      48  install -Dm644 README.md "$pkgdir/usr/share/doc/$_pkgname/README.md"
    
      49  install -Dm644 spec.md "$pkgdir/usr/share/doc/$_pkgname/spec.md"
    
      50  install -Dm644 -t "$pkgdir/usr/share/doc/$_pkgname/examples" examples/*.toml
    
      51  install -Dm755 -t "$pkgdir/usr/share/doc/$_pkgname/examples" examples/*.sh
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-14 17:17:35	Low	2