deepseek-harness-desktop-bin

MEDIUM

maintainer czyt 0 votes scanned 2026-10-06 00:13:36.889724

View on AUR

Why flagged

The package installs a prebuilt .deb from a GitHub release by a contributor, not the official project; the binary is unverifiable and could be silently swapped, posing a supply-chain risk despite plausible project association.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The package installs a prebuilt .deb from a GitHub release by a contributor, not the official project; the binary is unverifiable and could be silently swapped, posing a supply-chain risk despite plausible project association.

PKGBUILD

      1# Maintainer: czyt <czytcn@gmail.com>
    
      2# Contributor: ZacharyZhang-NY <ZacharyZhang-NY@users.noreply.github.com>
    
      3# Repackages the Desktop .deb built by `pnpm run package:desktop:linux:x64`.
    
      4
    
      5pkgname=deepseek-harness-desktop-bin
    
      6_pkgver=0.2.0-rc.2
    
      7pkgver=${_pkgver//-/}
    
      8pkgrel=1
    
      9pkgdesc='Desktop shell for the DeepSeek Harness agent runtime'
    
      10arch=('x86_64')
    
      11url='https://github.com/deepseek-ai/deepseek-harness'
    
      12license=('MIT')
    
      13depends=('gtk3' 'nss' 'alsa-lib' 'libxss' 'libxtst' 'libnotify' 'libsecret' 'xdg-utils' 'at-spi2-core' 'util-linux-libs')
    
      14optdepends=('libayatana-appindicator: system tray icon support')
    
      15provides=('deepseek-harness-desktop')
    
      16conflicts=('deepseek-harness-desktop')
    
      17options=('!strip' '!debug')
    
      18_deb="deepseek-harness-${_pkgver}-linux-amd64.deb"
    
      19source=("${_deb}::https://github.com/ZacharyZhang-NY/deepseek-harness/releases/download/desktop-v${_pkgver}/${_deb}")
    
      20noextract=("${_deb}")
    
      21sha256sums=('defc5e533be640159c9d83b8059f1b6ed23178cd6253f6d5755d714f5099d4fa')
    
      22
    
      23package() {
    
      24    bsdtar -xOf "${_deb}" 'data.tar.*' | bsdtar -xf - -C "${pkgdir}"
    
      25
    
      26    # The .deb creates these in its postinst script, which pacman does not run.
    
      27    install -d "${pkgdir}/usr/bin"
    
      28    ln -s '/opt/DeepSeek Harness/deepseek-harness' "${pkgdir}/usr/bin/deepseek-harness"
    
      29    chmod 4755 "${pkgdir}/opt/DeepSeek Harness/chrome-sandbox"
    
      30    install -Dm644 "${pkgdir}/opt/DeepSeek Harness/LICENSE.electron.txt" \
    
      31        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
    
      32}
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 00:13:36	Medium	2
2026-10-05 23:40:58	Low	1