deepseek-harness-eac-bin
LOW
maintainer Rownix
0 votes
scanned 2026-10-20 17:28:05.182546
Why flagged
The package repackages a prebuilt Debian binary from the project's official GitHub repository; while the host is not whitelisted, the source is verifiable and the build process is transparent with checksum validation and layout checks, limiting risk to typical supply-chain concerns for binary packages.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package repackages a prebuilt Debian binary from the project's official GitHub repository; while the host is not whitelisted, the source is verifiable and the build process is transparent with checksum validation and layout checks, limiting risk to typical supply-chain concerns for binary packages.
PKGBUILD
1
# Maintainer: Rownix <rownix101@gmail.com>
2
# Upstream: https://github.com/Ebony-Vinyl/EAC-Desktop (MIT)
3
#
4
# This package repackages the upstream Debian build; nothing is compiled here.
5
#
6
# Three upstream quirks are encoded below on purpose:
7
#
8
# 1. Linux artifacts are published only for *some* releases. Recent tags
9
# (v6.0.x) are Windows-only, so "latest release" is not a valid signal --
10
# the updater scans every release and picks the newest one that actually
11
# ships an amd64 .deb.
12
# 2. The release tag is not always "v${pkgver}": upstream has used
13
# v4.4.0-linux, v5.3.1-linux, ... . The exact tag is tracked in _tag and
14
# the exact asset name in _debname.
15
# 3. The payload must keep its original paths. See package() below.
16
#
17
# scripts/update-pkgbuild.py maintains pkgver/pkgrel/_tag/_debname/sha256sums.
18
19
pkgname=deepseek-harness-eac-bin
20
pkgver=5.3.6
21
pkgrel=3
22
pkgdesc='DeepSeek Harness EAC - desktop workbench for DSH plugins (upstream Debian build)'
23
arch=('x86_64')
24
url='https://github.com/Ebony-Vinyl/EAC-Desktop'
25
license=('MIT')
26
depends=(
27
'cairo'
28
'dbus'
29
'gcc-libs'
30
'gdk-pixbuf2'
31
'glib2'
32
'glibc'
33
'gtk3'
34
'hicolor-icon-theme'
35
'libayatana-appindicator'
36
'libsoup3'
37
'webkit2gtk-4.1'
38
)
39
optdepends=(
40
'libnotify: desktop notifications'
41
'wl-clipboard: clipboard support on Wayland'
42
'xclip: clipboard support on X11'
43
)
44
provides=('deepseek-harness-eac')
45
conflicts=('deepseek-harness-eac')
46
# Prebuilt binaries: never strip them, and do not emit a debug package.
47
options=('!strip' '!debug')
48
49
_tag='v5.3.6'
50
_debname='Deepseek.Harness.EAC_5.3.6_amd64.deb'
51
source=("${_debname}::${url}/releases/download/${_tag}/${_debname}")
52
sha256sums=('05acc5e789d1a3919d56bfc21f1b7f97b764f9be48d5fd39a76108606605a2fc')
53
# Unpack the .deb ourselves in package(); letting makepkg do it would scatter
54
# debian-binary/control.tar.gz/data.tar.gz loose in $srcdir.
55
noextract=("${_debname}")
56
57
# Unpack a .deb (an ar(1) archive) and print the path of its data member.
58
# bsdtar ships with libarchive in base, so dpkg is not needed on Arch.
59
# --no-same-owner is required: the archive records Debian's builder uid/gid,
60
# which cannot be applied inside makepkg's fakeroot.
61
_unpack_deb() {
62
local dest=$1 member
63
rm -rf "$dest"
64
mkdir -p "$dest"
65
bsdtar -xf "${_debname}" -C "$dest" --no-same-owner || return 1
66
member=$(find "$dest" -maxdepth 1 -type f -name 'data.tar.*' -print -quit)
67
[[ -n $member ]] || { error 'no data.tar.* member found inside the .deb'; return 1; }
68
printf '%s\n' "$member"
69
}
70
71
check() {
72
cd "$srcdir"
73
74
local data_tar listing
75
data_tar=$(_unpack_deb "$srcdir/.check-deb") || return 1
76
listing=$(mktemp)
77
bsdtar -tf "$data_tar" > "$listing" || return 1
78
79
# Everything the Tauri shell and its Node sidecar need at boot. If upstream
80
# renames or drops any of these, the package must not be published blindly.
81
local required=(
82
'usr/bin/dsh-eac-shell'
83
'usr/lib/Deepseek Harness EAC/sidecar/server.js'
84
'usr/lib/Deepseek Harness EAC/dsh-desktop/package.json'
85
'usr/lib/Deepseek Harness EAC/dsh-desktop/bundle-manifest.json'
86
'usr/lib/Deepseek Harness EAC/dsh-desktop/vendor/node/node'
87
'usr/lib/Deepseek Harness EAC/dsh-desktop/vendor/npm/bin/npm-cli.js'
88
'usr/share/applications/Deepseek Harness EAC.desktop'
89
'usr/share/icons/hicolor/900x900/apps/dsh-eac-shell.png'
90
)
91
local path
92
for path in "${required[@]}"; do
93
# tar listings may or may not carry a leading "./".
94
if ! grep -qxF -e "$path" -e "./$path" "$listing"; then
95
error "upstream .deb is missing a required path: $path"
96
rm -f "$listing"
97
return 1
98
fi
99
done
100
101
# The Debian control metadata must still describe an amd64 package.
102
local control_dir="$srcdir/.check-deb/control"
103
local control_tar="$srcdir/.check-deb/control.tar.gz"
104
if [[ -f $control_tar ]]; then
105
mkdir -p "$control_dir"
106
if bsdtar -xf "$control_tar" -C "$control_dir" --no-same-owner 2>/dev/null \
107
&& [[ -f $control_dir/control ]]; then
108
if ! grep -qx 'Architecture: amd64' "$control_dir/control"; then
109
error 'upstream .deb no longer targets amd64'
110
rm -f "$listing"
111
return 1
112
fi
113
fi
114
fi
115
116
rm -f "$listing"
117
msg 'payload layout verified'
118
}
119
120
package() {
121
cd "$srcdir"
122
123
local data_tar
124
data_tar=$(_unpack_deb "$srcdir/.build-deb") || return 1
125
bsdtar -xf "$data_tar" -C "$pkgdir" --no-same-owner
126
127
# Keep the upstream layout byte-for-byte -- do not "clean up" the paths.
128
# The Tauri shell resolves its resources relative to the real executable and
129
# additionally probes /usr/lib/<productName>; relocating the payload makes the
130
# Node sidecar spawn with wrong paths ("ignoring invalid resource directory"
131
# then "sidecar exited") and the app fails at boot. For the same reason
132
# nothing may be pruned from dsh-desktop/: bundle-integrity.js compares
133
# per-package file counts against bundle-manifest.json at startup and reports
134
# a damaged bundle when files go missing.
135
chmod 755 "$pkgdir/usr/bin/dsh-eac-shell"
136
chmod 755 "$pkgdir/usr/lib/Deepseek Harness EAC/dsh-desktop/vendor/node/node"
137
138
# Upstream ships an empty Categories=, which leaves the app in the "Other"
139
# menu (or nowhere) on most desktops. Nothing validates this file at runtime,
140
# so it is safe to correct.
141
local desktop="$pkgdir/usr/share/applications/Deepseek Harness EAC.desktop"
142
sed -i 's/^Categories=.*/Categories=Development;/' "$desktop"
143
grep -q '^StartupNotify=' "$desktop" || sed -i '/^StartupWMClass=/i StartupNotify=true' "$desktop"
144
}
145
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-20 17:28:05 | Low | 2 |