floral-notepaper-app

MEDIUM

maintainer czyt 0 votes scanned 2026-10-26 15:45:54.756943

View on AUR

Why flagged

The package installs a prebuilt Debian package from GitHub Releases, which is an unverifiable executable binary; if the source were swapped, it could contain malicious code, though it originates from a project-owned repository.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt Debian package from GitHub Releases, which is an unverifiable executable binary; if the source were swapped, it could contain malicious code, though it originates from a project-owned repository.

PKGBUILD

      1# Maintainer: czyt <czytcn@gmail.com>
    
      2pkgname=floral-notepaper-app
    
      3pkgver=1.2.0
    
      4pkgrel=1
    
      5pkgdesc="花笺 — A lightweight, elegant cross-platform desktop sticky note app with Markdown support (Tauri/Rust)"
    
      6arch=(x86_64)
    
      7url="https://github.com/Achilng/floral-notepaper"
    
      8license=(MIT)
    
      9depends=(gtk3 webkit2gtk-4.1 libayatana-appindicator)
    
      10provides=(floral-notepaper)
    
      11conflicts=(floral-notepaper)
    
      12options=(!strip !debug)
    
      13
    
      14# Upstream deb control metadata may lag the release tag (1.2.0 deb still
    
      15# declares Version: 1.0.4); the binary embeds the real version string.
    
      16_deb="floral-notepaper_${pkgver}_amd64.deb"
    
      17source=("${_deb}::https://github.com/Achilng/floral-notepaper/releases/download/v${pkgver}/${_deb}"
    
      18        "LICENSE-${pkgver}::https://raw.githubusercontent.com/Achilng/floral-notepaper/v${pkgver}/LICENSE")
    
      19sha256sums=('aafe846a5761b18397094700a7993e518528902fd22af62eab67494397321810'
    
      20            'e4df1e97f2ee75fe597e567546bf3070f5b09c9cc4879666b53fe5254e00994e')
    
      21noextract=("${_deb}")
    
      22
    
      23# The release ships SHA256SUMS.txt; the update workflow verifies the deb
    
      24# against it before staging, since checksums here stay SKIP on GitHub.
    
      25
    
      26package() {
    
      27    # Dynamic member lookup: do not assume a fixed compression format
    
      28    bsdtar -xOf "${srcdir}/${_deb}" "data.tar.*" |
    
      29        bsdtar --no-same-owner -xf - -C "${pkgdir}"
    
      30
    
      31    # Upstream desktop file ships with empty Categories; add Utility like the
    
      32    # existing community package does
    
      33    sed -i "s/Categories=/Categories=Utility;/" \
    
      34        "${pkgdir}/usr/share/applications/floral-notepaper.desktop"
    
      35
    
      36    install -Dm644 "${srcdir}/LICENSE-${pkgver}" \
    
      37        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-26 15:45:54	Medium	2