dsearch

maintainer almajessen · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt binaries from GitHub releases for x86_64 and aarch64, which is a supply-chain risk if the host is compromised, but the sources are from the project's official repository with verifiable checksums, and no obfuscated or remote code execution is present.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads prebuilt binaries from GitHub releases for x86_64 and aarch64, which is a supply-chain risk if the host is compromised, but the sources are from the project's official repository with verifiable checksums, and no obfuscated or remote code execution is present.

PKGBUILD

      1# Maintainer: Avenge Media <avengemediallc at gmail dot com>
    
      2_pkgauthor=AvengeMedia
    
      3_repo=danksearch
    
      4_binname=dsearch
    
      5
    
      6pkgname=dsearch
    
      7pkgver=0.3.2
    
      8pkgrel=1
    
      9pkgdesc="Fast filesystem search service"
    
      10arch=('x86_64' 'aarch64')
    
      11_barch=('amd64' 'arm64')
    
      12url="https://github.com/${_pkgauthor}/${_repo}"
    
      13_urlraw="https://raw.githubusercontent.com/${_pkgauthor}/${_repo}/v${pkgver}"
    
      14license=('MIT')
    
      15provides=("${_binname}")
    
      16conflicts=("${_binname}")
    
      17
    
      18source=(
    
      19  "LICENSE-${pkgver}::${_urlraw}/LICENSE"
    
      20  "README-${pkgver}.md::${_urlraw}/README.md"
    
      21  'linter'
    
      22  "dsearch.service"  # local file next to PKGBUILD (same as -git)
    
      23)
    
      24source_x86_64=("${_binname}-${arch[0]}-${pkgver}.gz::${url}/releases/download/v${pkgver}/${_binname}-linux-${_barch[0]}.gz")
    
      25source_aarch64=("${_binname}-${arch[1]}-${pkgver}.gz::${url}/releases/download/v${pkgver}/${_binname}-linux-${_barch[1]}.gz")
    
      26
    
      27sha256sums=('4cee96286c5b7da9763a4694868bb1853b33bb1558821e0c609ad2eabd426bfa'
    
      28            '6a4cb2d57168eff67f565dc45b71cf118b6c02f69c3fa35184fd670196c54306'
    
      29            '6908e1e996cf4c457543dbf108e70c9dda7b03229dd11badd3a28598373e5b4b')
    
      30sha256sums_x86_64=('2c9e433f82948c77488543d25955a170835755a39d29ecc2240a8e4d74be63fd')
    
      31sha256sums_aarch64=('3fc789090ac1e932e3ee72430086ddc31b7bf8ccdb6a8c0f145fd256a8fd4400')
    
      32
    
      33package() {
    
      34  cd "${srcdir}" || exit 1
    
      35
    
      36  # makepkg auto-ungzips the aliased sources to "${_binname}-${CARCH}-${pkgver}"
    
      37  install -Dm755 "${_binname}-${CARCH}-${pkgver}" "${pkgdir}/usr/bin/${_binname}"
    
      38
    
      39  # systemd user unit (same path as your -git package)
    
      40  install -Dm644 "dsearch.service" "${pkgdir}/usr/lib/systemd/user/dsearch.service"
    
      41
    
      42  # docs
    
      43  install -Dm644 "LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/dsearch/LICENSE"
    
      44  install -Dm644 "README-${pkgver}.md" "${pkgdir}/usr/share/doc/dsearch/README.md"
    
      45}
    
      46
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 13:20:32	LOW	2