emposium

MEDIUM

maintainer amanomasato 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

Installs a prebuilt binary fetched from the project's own API endpoint (api.emposium.ru), which is an unofficial/personal-project host with no independent verification; the checksum is present but the binary itself is unreviewed closed-source software from a low-reputation source, making silent substitution or supply-chain risk realistic.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("emposium-${pkgver}.tar.gz::https://api.emposium.ru/v1/releases/0.6.2/downloads/linux-tar")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs a prebuilt binary fetched from the project's own API endpoint (api.emposium.ru), which is an unofficial/personal-project host with no independent verification; the checksum is present but the binary itself is unreviewed closed-source software from a low-reputation source, making silent substitution or supply-chain risk realistic.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: amanomasato
    
      2pkgname=emposium
    
      3pkgver=0.6.2
    
      4pkgrel=1
    
      5pkgdesc='Anime, manga and community in one application'
    
      6arch=('x86_64')
    
      7url='https://emposium.ru'
    
      8license=('custom')
    
      9depends=('dbus' 'webkit2gtk-4.1' 'gtk3' 'glib-networking' 'libayatana-appindicator' 'gst-plugins-base' 'gst-plugins-good' 'gst-plugins-bad' 'gst-libav')
    
      10optdepends=('gnome-keyring: Secret Service for secure session storage')
    
      11options=('!strip')
    
      12source=("emposium-${pkgver}.tar.gz::https://api.emposium.ru/v1/releases/0.6.2/downloads/linux-tar")
    
      13sha256sums=('941d4ac426cb09d9b5dbe35ef8b734bae45241a99efcfdb3a92cdec5a7762b58')
    
      14
    
      15package() {
    
      16  install -Dm755 "$srcdir/emposium/bin/emposium" "$pkgdir/usr/lib/emposium/emposium"
    
      17  install -Dm755 "$srcdir/emposium/emposium-managed" "$pkgdir/usr/bin/emposium"
    
      18  install -Dm644 "$srcdir/emposium/ru.emposium.app.desktop" "$pkgdir/usr/share/applications/ru.emposium.app.desktop"
    
      19  install -Dm644 "$srcdir/emposium/emposium.png" "$pkgdir/usr/share/icons/hicolor/256x256/apps/ru.emposium.app.png"
    
      20  install -Dm644 "$srcdir/emposium/THIRD-PARTY-NOTICES.txt" "$pkgdir/usr/share/licenses/$pkgname/THIRD-PARTY-NOTICES.txt"
    
      21  install -Dm644 "$srcdir/emposium/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      22}
    
      23

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	3
2026-10-16 00:12:47	Medium	3
2026-10-15 00:28:05	Medium	3
2026-10-14 00:06:47	Medium	3
2026-10-13 00:23:45	Medium	3
2026-10-12 00:18:51	Medium	3
2026-10-11 00:26:05	Medium	3
2026-10-10 00:11:52	Medium	3
2026-10-09 22:16:23	Medium	3
2026-10-09 22:12:40	Medium	2