emaki-bin

MEDIUM

maintainer novica 0 votes scanned 2026-10-24 17:41:05.329835

View on AUR

Why flagged

The package downloads prebuilt .deb binaries from GitHub releases for x86_64 and aarch64, which are then extracted and installed; while the source is from a plausible project owner, the use of unverifiable prebuilt executables creates a supply-chain risk if the release assets were compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package downloads prebuilt .deb binaries from GitHub releases for x86_64 and aarch64, which are then extracted and installed; while the source is from a plausible project owner, the use of unverifiable prebuilt executables creates a supply-chain risk if the release assets were compromised.

PKGBUILD

      1# Maintainer: novica <nnovica@gmail.com>
    
      2
    
      3pkgname=emaki-bin
    
      4pkgver=0.3.1 # renovate: datasource=github-releases depName=alkaline-software/emaki
    
      5pkgrel=1
    
      6pkgdesc="An agentic development environment"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://github.com/alkaline-software/emaki"
    
      9license=('MIT')
    
      10depends=(
    
      11    glibc
    
      12    libgcc
    
      13    libxcb
    
      14    libxkbcommon
    
      15    libxkbcommon-x11
    
      16    fontconfig
    
      17    freetype2
    
      18    wayland
    
      19    vulkan-icd-loader
    
      20    hicolor-icon-theme
    
      21)
    
      22optdepends=('xdg-desktop-portal: file picker and secret storage')
    
      23provides=("emaki=${pkgver}")
    
      24conflicts=('emaki')
    
      25options=('!debug' '!strip')
    
      26source=("LICENSE-${pkgver}::https://raw.githubusercontent.com/alkaline-software/emaki/v${pkgver}/LICENSE")
    
      27source_x86_64=("${pkgname}-${pkgver}-x86_64.deb::${url}/releases/download/v${pkgver}/Emaki-linux-x64.deb")
    
      28source_aarch64=("${pkgname}-${pkgver}-aarch64.deb::${url}/releases/download/v${pkgver}/Emaki-linux-arm64.deb")
    
      29
    
      30package() {
    
      31    bsdtar -xf data.tar.gz -C "$pkgdir"
    
      32    install -Dm644 "LICENSE-${pkgver}" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      33}
    
      34
    
      35sha256sums=('7c7aa1f981bbd6e9285dc04212226c84ea31caec4e01fbce6ebcc9f035d95324')
    
      36sha256sums_x86_64=('e68dd61e89b12140fc536087cb50c0ff9bece03a30b494ecd332c74b605c04d2')
    
      37sha256sums_aarch64=('f7617b7c7519431e17c4bd232f0e7769bab6b5f846ce693ee32f1145e80ad5ab')
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-24 17:41:05	Medium	2