diskpush-bin

MEDIUM

maintainer Dominiquini 1 votes scanned 2026-10-20 07:27:55.767015

View on AUR

Why flagged

The package installs a prebuilt .deb from GitHub releases, which is an unverifiable binary executable; if the source were swapped maliciously, it could lead to code execution, though the host (GitHub) is generally trusted.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt .deb from GitHub releases, which is an unverifiable binary executable; if the source were swapped maliciously, it could lead to code execution, though the host (GitHub) is generally trusted.

PKGBUILD

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      2
    
      3_gitauthor=profullstack
    
      4_gitname=diskpush
    
      5_appname=${_gitname}
    
      6pkgname=${_gitname}-bin
    
      7pkgdesc="Push files fast. Sync only what changed."
    
      8
    
      9pkgver=0.16.3
    
      10pkgrel=1
    
      11_gitversion=v${pkgver}
    
      12
    
      13arch=('x86_64')
    
      14_barch=('linux-amd64')
    
      15
    
      16_ghurl="https://github.com/${_gitauthor}/${_gitname}"
    
      17_ghurlraw="https://raw.githubusercontent.com/${_gitauthor}/${_gitname}/${_gitversion}"
    
      18url=${_ghurl}
    
      19
    
      20license=('MIT')
    
      21
    
      22provides=("${_appname}")
    
      23conflicts=("${pkgname%-bin}")
    
      24
    
      25depends=('bash' 'expat' 'libdrm' 'libcups' 'libx11' 'nodejs' 'libgcc' 'nspr' 'cairo' 'systemd-libs' 'nss' 'at-spi2-core' 'libxkbcommon' 'mesa' 'alsa-lib' 'glibc' 'libxcomposite' 'libxext' 'libxcb' 'libxfixes' 'pango' 'glib2' 'libxdamage' 'gtk3' 'dbus' 'libxrandr' 'hicolor-icon-theme')
    
      26
    
      27options=('!strip')
    
      28
    
      29source=("README-${pkgver}.md::${_ghurlraw}/README.md"
    
      30		"LICENSE-${pkgver}::${_ghurlraw}/LICENSE")
    
      31source_x86_64=("${_appname}-${arch[0]}-${pkgver}.deb::${_ghurl}/releases/download/${_gitversion}/${_appname}-${pkgver}-${_barch[0]}.deb")
    
      32sha256sums=('89fa42eb81de16b5e079c5d3e86225bd4f4419fe4b522b6aed1ab814f34a6228'
    
      33            'de1b680e8cf8ebf3641646e14f5c0730f726da2d9d6d211d498032c20d0d9e2c')
    
      34sha256sums_x86_64=('f831b6dd4097b8733a1a773010b3c9584dcf0294f8c913f5b3b9e7835afbdb4e')
    
      35
    
      36
    
      37prepare() {
    
      38	cd "${srcdir}/" || exit
    
      39
    
      40	rm -rf git && git clone -n --depth=1 --filter=tree:0 "${_ghurl}" git
    
      41
    
      42	cd git && git sparse-checkout set --no-cone /docs && git checkout
    
      43
    
      44	cp -rfa docs "${srcdir}/" && cd .. && rm -rf git
    
      45}
    
      46
    
      47package() {
    
      48	cd "${srcdir}/" || exit
    
      49
    
      50	tar -xf "data.tar.xz" --hard-dereference -C "${pkgdir}"
    
      51
    
      52	rm -rf "${pkgdir}/usr/share/doc/"
    
      53
    
      54	mv "${pkgdir}/opt/"*"/" "${pkgdir}/opt/${_appname}"
    
      55	sed -e "s|Exec=/opt/.*/diskpush-desktop|Exec=/opt/${_appname}/diskpush-desktop|g" -i "${pkgdir}/usr/share/applications/"*".desktop"
    
      56
    
      57	install -dm755 "${pkgdir}/usr/bin/"
    
      58	ln -sf "/opt/${_appname}/${_appname}-desktop" "${pkgdir}/usr/bin/${_appname}-desktop"
    
      59
    
      60	install -Dm755 /dev/stdin "$pkgdir/usr/bin/${_appname}" << END
    
      61#!/usr/bin/env sh
    
      62exec "/opt/${_appname}/resources/cli/${_appname}" "\$@"
    
      63END
    
      64
    
      65	install -Dm644 "README-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      66
    
      67	for doc in docs/*.md; do
    
      68		install -Dm644 "${doc}" "${pkgdir}/usr/share/doc/${pkgname}/$(name=$(basename "${doc}" .md); echo "${name^^}.md")"
    
      69	done
    
      70
    
      71	install -Dm644 "LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      72}
    
      73

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-20 07:27:55	Medium	2