driftwm-bin

MEDIUM

maintainer antonio_breno 0 votes scanned 2026-10-25 01:41:32.578424

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release under a different user (qofqoflop) than the project's source repository (malbiruk), creating a supply-chain risk with no verification of the binary's origin or integrity beyond a fixed checksum.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt binary from a GitHub release under a different user (qofqoflop) than the project's source repository (malbiruk), creating a supply-chain risk with no verification of the binary's origin or integrity beyond a fixed checksum.

PKGBUILD

      1pkgname=driftwm-bin
    
      2pkgver=0.20.0
    
      3pkgrel=1
    
      4pkgdesc="Trackpad-first infinite canvas Wayland compositor - Prebuilt binary distribution"
    
      5arch=('x86_64')
    
      6url="https://github.com/malbiruk/driftwm"
    
      7license=('GPL-3.0-or-later')
    
      8
    
      9depends=('libdisplay-info' 'libinput' 'seatd' 'mesa' 'libxkbcommon')
    
      10
    
      11provides=("driftwm=$pkgver")
    
      12conflicts=('driftwm')
    
      13
    
      14source=("https://github.com/qofqoflop/driftwm-bin/releases/download/v${pkgver}/driftwm-linux-x86_64.tar.gz")
    
      15sha256sums=('043d7cd41b287a259a65962005fb613dc8d866208bac852ea332d29201ab38e7')
    
      16
    
      17package() {
    
      18    cp -a "$srcdir/." "$pkgdir/"
    
      19}
    
      20

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-25 01:41:32	Medium	2