dsh-desktop-bin

LOW

maintainer arch_git 0 votes scanned 2026-09-25 11:11:47.608437

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release of a forked project, which is a supply-chain risk, but it is not actively malicious; the source is transparent and verifiable, and no remote code execution or obfuscation is present.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from a GitHub release of a forked project, which is a supply-chain risk, but it is not actively malicious; the source is transparent and verifiable, and no remote code execution or obfuscation is present.

PKGBUILD

      1# Maintainer: xy-arch-git <333688328+xy-arch-git at users dot noreply dot github dot com>
    
      2#
    
      3# Prebuilt Linux x86_64 package. The tarball is produced by the public CI pipeline at
    
      4# https://github.com/xy-arch-git/dsh-desktop-linux and downloaded from its releases.
    
      5# Not affiliated with upstream.
    
      6
    
      7pkgname=dsh-desktop-bin
    
      8pkgver=0.9.2
    
      9pkgrel=1
    
      10pkgdesc='Cross-platform desktop shell for DeepSeek Harness: local Agent runtime, model providers, mobile phone pairing, editable PPTX generation'
    
      11arch=('x86_64')
    
      12url='https://github.com/dataelement/dsh-desktop'
    
      13license=('MIT')
    
      14depends=('alsa-lib'
    
      15         'at-spi2-core'
    
      16         'brotli'
    
      17         'c-ares'
    
      18         'flac'
    
      19         'fontconfig'
    
      20         'freetype2'
    
      21         'gcc-libs'
    
      22         'glibc'
    
      23         'gtk3'
    
      24         'harfbuzz'
    
      25         'libdrm'
    
      26         'libevent'
    
      27         'libffi'
    
      28         'libjpeg-turbo'
    
      29         'libnotify'
    
      30         'libpulse'
    
      31         'libsecret'
    
      32         'libxcomposite'
    
      33         'libxdamage'
    
      34         'libxkbcommon'
    
      35         'libxrandr'
    
      36         'libxss'
    
      37         'libxtst'
    
      38         'libxml2'
    
      39         'libxslt'
    
      40         'minizip'
    
      41         'nss'
    
      42         'opus'
    
      43         'util-linux'
    
      44         'xdg-utils'
    
      45         'zlib')
    
      46optdepends=('libappindicator-gtk3: system tray icon support'
    
      47            'pipewire: WebRTC desktop sharing under Wayland')
    
      48provides=('dsh-desktop')
    
      49conflicts=('dsh-desktop')
    
      50# Bundled Electron must not be stripped; no debug package is needed either.
    
      51options=('!strip' '!debug')
    
      52
    
      53_ghrepo='xy-arch-git/dsh-desktop-linux'
    
      54_archive="dsh-desktop-$pkgver-linux-x64.tar.zst"
    
      55
    
      56# Asset layout: app/ (electron-builder linux-unpacked), dsh-desktop.desktop, icons/, LICENSE
    
      57source=("$pkgname-$pkgver.tar.zst::https://github.com/$_ghrepo/releases/download/v$pkgver/$_archive")
    
      58sha256sums=('b8198fe08c02e749730b55b3bb0198e14b52661058cc753b0d909b362a48330a')
    
      59
    
      60package() {
    
      61  local src="$srcdir/dsh-desktop-$pkgver-linux-x64"
    
      62  [[ -d "$src/app" ]] || { echo "error: $src/app not found" >&2; exit 1; }
    
      63
    
      64  install -d "$pkgdir/opt/dsh-desktop"
    
      65  cp -r "$src/app/." "$pkgdir/opt/dsh-desktop/"
    
      66  chmod 755 "$pkgdir/opt/dsh-desktop/dsh-desktop"
    
      67
    
      68  install -d "$pkgdir/usr/bin"
    
      69  ln -s /opt/dsh-desktop/dsh-desktop "$pkgdir/usr/bin/dsh-desktop"
    
      70
    
      71  install -Dm644 "$src/dsh-desktop.desktop" \
    
      72    "$pkgdir/usr/share/applications/dsh-desktop.desktop"
    
      73
    
      74  local png size
    
      75  for png in "$src"/icons/*.png; do
    
      76    size=$(basename "$png" .png)
    
      77    install -Dm644 "$png" "$pkgdir/usr/share/icons/hicolor/${size}/apps/dsh-desktop.png"
    
      78  done
    
      79
    
      80  install -Dm644 "$src/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      81}
    
      82

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-25 11:11:47	Low	2
2026-09-25 09:11:17	Low	2