domicile-bin

MEDIUM

maintainer cprussin 0 votes scanned 2026-10-21 00:12:50.227280

View on AUR

Why flagged

Downloads and installs a prebuilt binary package from a personal/project-owned server (domicile-packages.prussin.net) that is not official distribution infrastructure; while the checksum is present and the host appears to be the project maintainer's own server, the prebuilt executable artifact comes from a non-whitelisted personal host that could be silently swapped, making it an unverifiable binary install.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("domicile-1.0.0pre.20261020.223729-1-x86_64.pkg.tar.zst::https://domicile-packages.prussin.net/arch/x86_64/domicile-1.0.0pre.20261020.223729-1-x86_64.pkg.tar.zst")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 80%): Downloads and installs a prebuilt binary package from a personal/project-owned server (domicile-packages.prussin.net) that is not official distribution infrastructure; while the checksum is present and the host appears to be the project maintainer's own server, the prebuilt executable artifact comes from a non-whitelisted personal host that could be silently swapped, making it an unverifiable binary install.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Connor Prussin <connor@prussin.net>
    
      2# Written by distro/aur.sh in https://github.com/cprussin/domicile.
    
      3pkgname=domicile-bin
    
      4pkgver=1.0.0pre.20261020.223729
    
      5pkgrel=1
    
      6pkgdesc=A\ Wayland\ compositor\ whose\ renderer\ is\ a\ web\ engine.\ Installs\ the\ \`domicile\`\ login\ session\,\ the\ engine\,\ the\ manganese\ and\ simple\ shells\,\ the\ PAM\ service\ the\ lock\ uses\ and\ the\ \`domicile\`\ group.
    
      7arch=(x86_64)
    
      8url=https://github.com/cprussin/domicile
    
      9license=( MIT\ AND\ BSD-3-Clause )
    
      10depends=( glibc\>=2.34 gcc-libs glib2 nss nspr at-spi2-core dbus libcups expat libxkbcommon alsa-lib mesa systemd-libs libinput cairo pango pipewire libglvnd wayland pam systemd )
    
      11optdepends=( upower:\ the\ battery\ readout hwdata:\ monitor\ makers\'\ names libpulse:\ pactl\,\ for\ the\ volume\ readout curl:\ bookmark\ icons\ and\ the\ captive\ portal\ check xdg-desktop-portal:\ portals\ for\ apps gsettings-desktop-schemas:\ the\ engine\'s\ GSettings\ schemas\,\ without\ which\ it\ logs\ errors )
    
      12provides=(domicile)
    
      13conflicts=(domicile)
    
      14backup=( etc/pam.d/domicile etc/security/limits.d/10-domicile.conf )
    
      15install=domicile.install
    
      16source=("domicile-1.0.0pre.20261020.223729-1-x86_64.pkg.tar.zst::https://domicile-packages.prussin.net/arch/x86_64/domicile-1.0.0pre.20261020.223729-1-x86_64.pkg.tar.zst")
    
      17noextract=("domicile-1.0.0pre.20261020.223729-1-x86_64.pkg.tar.zst")
    
      18sha256sums=(fad3361774bf0704afaf957c0c411cda6a7b97dc067d16b08f90fff15a0d3f43)
    
      19
    
      20package() {
    
      21  bsdtar -xpf "$srcdir/domicile-1.0.0pre.20261020.223729-1-x86_64.pkg.tar.zst" -C "$pkgdir" \
    
      22    --exclude .PKGINFO --exclude .MTREE --exclude .BUILDINFO --exclude .INSTALL
    
      23}
    
      24

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-21 00:12:50	Medium	3
2026-10-20 23:31:35	Medium	3
2026-10-20 23:29:39	Medium	3