fluxa-desktop-bin
maintainer khooly
· 0 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package installs a prebuilt Debian binary from GitHub releases without source compilation, creating a supply-chain risk if the release asset is swapped, though it originates from the project's official repository.
Triggered rules
LOW
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
MEDIUM
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt Debian binary from GitHub releases without source compilation, creating a supply-chain risk if the release asset is swapped, though it originates from the project's official repository.
PKGBUILD
1
# Maintainer: KhooLy <seslikitapicinkhooly@gmail.com>
2
pkgname=fluxa-desktop-bin
3
pkgver=0.1.30
4
pkgrel=1
5
pkgdesc="Cross-platform desktop app for streaming and managing your media library"
6
arch=('x86_64')
7
url="https://github.com/FluxaMedia/fluxa-desktop"
8
license=('GPL-3.0-only')
9
depends=('webkit2gtk-4.1' 'gtk3' 'gst-plugins-base' 'gst-plugins-good' 'libayatana-appindicator' 'librsvg')
10
provides=('fluxa-desktop')
11
conflicts=('fluxa-desktop')
12
source=("https://github.com/FluxaMedia/fluxa-desktop/releases/download/v${pkgver}/Fluxa.Desktop_${pkgver}_amd64.deb")
13
sha256sums=('af5ff69240be8ad4bacdf441a3b5464d426038607ba23322cf33ab95627acf31')
14
15
package() {
16
cd "$srcdir"
17
ar x "Fluxa.Desktop_${pkgver}_amd64.deb"
18
tar -xf data.tar.* -C "$pkgdir"
19
}
20
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 21:16:48 | MEDIUM | 2 |