flectar-mail-bin

LOW

maintainer liveopt 0 votes scanned 2026-09-13 19:15:06.142757

View on AUR

Why flagged

The package downloads a prebuilt .deb from the project's official GitHub releases, which is then unpacked and installed; the source is verifiable via a matching checksum, and no untrusted or obfuscated code execution occurs during build or install.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt .deb from the project's official GitHub releases, which is then unpacked and installed; the source is verifiable via a matching checksum, and no untrusted or obfuscated code execution occurs during build or install.

PKGBUILD

      1# Maintainer: Yubo Cao <cao2006721@gmail.com>
    
      2
    
      3# Unofficial packaging of the upstream Flectar Mail release binaries. Flectar
    
      4# does not produce or support this package; see TRADEMARKS.md upstream.
    
      5
    
      6pkgname=flectar-mail-bin
    
      7pkgver=0.1.0alpha.5
    
      8# Upstream tags and release assets keep the SemVer prerelease hyphen
    
      9# (v0.1.0-alpha.5). pkgver may not contain one, and simply dropping it is what
    
      10# makes vercmp sort every prerelease *before* the eventual final 0.1.0, so no
    
      11# epoch is ever needed. Bump this together with pkgver.
    
      12_tagver=0.1.0-alpha.5
    
      13pkgrel=1
    
      14pkgdesc='Native email client built with Rust and Slint (unofficial build of the upstream release)'
    
      15arch=('x86_64')
    
      16url='https://github.com/flectar/mail'
    
      17license=('AGPL-3.0-only')
    
      18depends=('dbus' 'fontconfig' 'gcc-libs' 'glibc' 'hicolor-icon-theme' 'libx11'
    
      19         'libxcursor' 'libxi' 'libxkbcommon' 'libxkbcommon-x11' 'wayland'
    
      20         'xdg-utils')
    
      21optdepends=('xdg-desktop-portal: OAuth sign-in through the system browser and native file dialogs'
    
      22            'gnome-keyring: Secret Service provider for storing account credentials'
    
      23            'kwallet: alternative Secret Service provider'
    
      24            'gnupg: OpenPGP signing and encryption'
    
      25            'pinentry: passphrase prompts for GnuPG')
    
      26provides=("flectar-mail=$pkgver")
    
      27conflicts=('flectar-mail' 'flectar-mail-git')
    
      28options=('!strip' '!debug')
    
      29source=("$pkgname-$pkgver.deb::$url/releases/download/v$_tagver/flectar-mail_${_tagver//-/.}_amd64.deb")
    
      30# makepkg would happily unpack the `ar` container for us; keep it whole so
    
      31# package() is the only thing that decides what lands in $pkgdir.
    
      32noextract=("$pkgname-$pkgver.deb")
    
      33# Matches the SHA256SUMS published with the upstream release.
    
      34sha256sums=('8d1f113c6134498bff4beb67727a61665684fdb338dfcc9edea51e636905b1a9')
    
      35
    
      36package() {
    
      37    # The .deb is an `ar` archive; unpack its payload straight into $pkgdir.
    
      38    # Upstream already ships a plain FHS layout (/usr/bin, /usr/lib/flectar-mail,
    
      39    # /usr/share/...), so nothing has to be relocated.
    
      40    bsdtar -xf "$pkgname-$pkgver.deb" -C "$srcdir" data.tar.zst
    
      41    bsdtar -xpf "$srcdir/data.tar.zst" -C "$pkgdir"
    
      42
    
      43    # Upstream installs the AGPL text and third-party notices under
    
      44    # /usr/share/doc/flectar-mail; point the Arch license path at them instead
    
      45    # of shipping a second 34 KiB copy.
    
      46    install -dm755 "$pkgdir/usr/share/licenses"
    
      47    ln -s ../doc/flectar-mail "$pkgdir/usr/share/licenses/$pkgname"
    
      48}
    
      49

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-13 19:15:06	Low	2