filen-menubar-bin

maintainer philippgerard · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs a prebuilt binary from an upstream release on the maintainer's GitHub, which is a common and generally accepted practice for AUR packages; while the host is not a major vendor, it is plausibly the project's official source, and the binary is not executed during build but merely unpacked and installed as-is, with no obfuscation or remote code execution.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from an upstream release on the maintainer's GitHub, which is a common and generally accepted practice for AUR packages; while the host is not a major vendor, it is plausibly the project's official source, and the binary is not executed during build but merely unpacked and installed as-is, with no obfuscation or remote code execution.

PKGBUILD

      1# Maintainer: Philipp Gerard <philipp.gerard@zeitdenken.de>
    
      2
    
      3pkgname=filen-menubar-bin
    
      4_pkgname=filen-menubar
    
      5pkgver=0.1.31
    
      6pkgrel=1
    
      7pkgdesc="Lightweight system tray app for Filen cloud sync"
    
      8arch=('x86_64')
    
      9url="https://github.com/philippgerard/filen-menubar"
    
      10license=('MIT')
    
      11# Arch equivalents of the .deb's Depends: libgtk-3-0, libwebkit2gtk-4.1-0,
    
      12# libayatana-appindicator3-1. The .deb also pulls nodejs, but only because
    
      13# its sync backend is assumed to come from npm; filen-cli-bin ships a
    
      14# standalone binary that needs no node, so nodejs is optional here.
    
      15depends=('gtk3' 'webkit2gtk-4.1' 'libayatana-appindicator')
    
      16optdepends=('filen-cli-bin: sync backend, standalone binary (recommended)'
    
      17            'nodejs: only needed if you install @filen/cli through npm instead')
    
      18provides=("${_pkgname}=${pkgver}")
    
      19conflicts=("${_pkgname}")
    
      20# Prebuilt upstream binary: leave it exactly as shipped.
    
      21options=(!strip !debug !lto)
    
      22
    
      23source=("${pkgname}-${pkgver}.deb::${url}/releases/download/v${pkgver}/Filen.Menubar_${pkgver}_amd64.deb"
    
      24        "LICENSE-${pkgver}::${url}/raw/v${pkgver}/LICENSE")
    
      25# .deb is an ar archive; unpack it explicitly in package().
    
      26noextract=("${pkgname}-${pkgver}.deb")
    
      27sha256sums=('c491f7b25ca85e8d90fb27ee854df6588fd954fda18a4273fc7855a32af2f576'
    
      28            '63d3d5dbe2ed4b855613bc1d0cdaa541583985329fd66b4179f937eb55ded130')
    
      29
    
      30package() {
    
      31    local _debdir="${srcdir}/_deb"
    
      32
    
      33    rm -rf "$_debdir"
    
      34    install -d "$_debdir"
    
      35    bsdtar -xf "${srcdir}/${pkgname}-${pkgver}.deb" -C "$_debdir"
    
      36    bsdtar -xf "$_debdir"/data.tar.* -C "$pkgdir" usr/
    
      37
    
      38    chmod 755 "${pkgdir}/usr/bin/${_pkgname}"
    
      39
    
      40    # Upstream's productName ("Filen Menubar") becomes the desktop filename,
    
      41    # spaces and all. Match by glob so a productName change does not break us.
    
      42    local _desktop
    
      43    _desktop="$(find "${pkgdir}/usr/share/applications" -name '*.desktop' -print -quit)"
    
      44    [[ -n "$_desktop" ]] || {
    
      45        echo "==> no .desktop file in the .deb payload" >&2
    
      46        return 1
    
      47    }
    
      48    mv "$_desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      49
    
      50    # The .deb carries no copyright file, so install the license from the tag.
    
      51    install -Dm644 "${srcdir}/LICENSE-${pkgver}" \
    
      52        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      53}
    
      54

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,7 +2,7 @@
 
 pkgname=filen-menubar-bin
 _pkgname=filen-menubar
-pkgver=0.1.30
+pkgver=0.1.31
 pkgrel=1
 pkgdesc="Lightweight system tray app for Filen cloud sync"
 arch=('x86_64')
@@ -24,7 +24,7 @@
         "LICENSE-${pkgver}::${url}/raw/v${pkgver}/LICENSE")
 # .deb is an ar archive; unpack it explicitly in package().
 noextract=("${pkgname}-${pkgver}.deb")
-sha256sums=('e8993c5b57a02d47cd37489a5aaa7d9c2cd6491298cc00a0570b98fa0711834a'
+sha256sums=('c491f7b25ca85e8d90fb27ee854df6588fd954fda18a4273fc7855a32af2f576'
             '63d3d5dbe2ed4b855613bc1d0cdaa541583985329fd66b4179f937eb55ded130')
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 15:15:12	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 11:35:00	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 15:32:35	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 21:31:00	LOW	2
2026-07-25 19:30:43	LOW	2