forgecode-bin

maintainer DepsCian · 1 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package installs a pre-built binary from the project's official GitHub releases, which is normal for upstream-provided binaries; the orphaned status does not imply malicious intent or supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs a pre-built binary from the project's official GitHub releases, which is normal for upstream-provided binaries; the orphaned status does not imply malicious intent or supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1pkgname=forgecode-bin
    
      2pkgver=2.13.21
    
      3pkgrel=1
    
      4pkgdesc="CLI code assistant; pre-built upstream binary"
    
      5arch=('x86_64' 'aarch64')
    
      6url="https://github.com/tailcallhq/forgecode"
    
      7license=('Apache-2.0')
    
      8provides=('forge')
    
      9conflicts=('forge')
    
      10depends=('fzf' 'bat' 'fd')
    
      11_baseurl=https://github.com/tailcallhq/forgecode/releases/download/v${pkgver}
    
      12source_x86_64=("forge::${_baseurl}/forge-x86_64-unknown-linux-gnu")
    
      13source_aarch64=("forge::${_baseurl}/forge-aarch64-unknown-linux-gnu")
    
      14source=("LICENSE")
    
      15sha256sums_x86_64=('300acf69e39ea5a452e6544f3191470317a14226b6b1a91821c95815e07a8b88')
    
      16sha256sums_aarch64=('b9336b652c1233a07dea8eb4e864785e03c1d9706025768a19ac3b6646936539')
    
      17sha256sums=('3c9f90350449325ae2b1355d6aae26df25be58f1cfcb8ed6a44b9c4b10c663f9')
    
      18
    
      19package() {
    
      20  install -Dm0755 forge "$pkgdir/usr/bin/forge"
    
      21  ln -sf forge "$pkgdir/usr/bin/forgecode"
    
      22
    
      23  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      24}
    
      25

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-18 00:03
@@ -1,27 +1,19 @@
 pkgname=forgecode-bin
-pkgver=2.12.16
+pkgver=2.13.21
 pkgrel=1
-pkgdesc="An AI-powered code assistant CLI tool"
+pkgdesc="CLI code assistant; pre-built upstream binary"
 arch=('x86_64' 'aarch64')
-url="https://github.com/antinomyhq/forgecode"
+url="https://github.com/tailcallhq/forgecode"
 license=('Apache-2.0')
 provides=('forge')
 conflicts=('forge')
-depends=(
-  'fzf'
-  'bat'
-  'fd'
-)
+depends=('fzf' 'bat' 'fd')
 _baseurl=https://github.com/tailcallhq/forgecode/releases/download/v${pkgver}
-source_x86_64=(
-  "forge::${_baseurl}/forge-x86_64-unknown-linux-gnu"
-)
-source_aarch64=(
-  "forge::${_baseurl}/forge-aarch64-unknown-linux-gnu"
-)
+source_x86_64=("forge::${_baseurl}/forge-x86_64-unknown-linux-gnu")
+source_aarch64=("forge::${_baseurl}/forge-aarch64-unknown-linux-gnu")
 source=("LICENSE")
-sha256sums_x86_64=('74a7b1b8782c1da0d430d74735f5653df8f3aa0709e757f477008cae9239bad8')
-sha256sums_aarch64=('28d2357f1d58ae73108bd7d7a1abdaf63268694ce02663d621e4dec11f9a5b59')
+sha256sums_x86_64=('300acf69e39ea5a452e6544f3191470317a14226b6b1a91821c95815e07a8b88')
+sha256sums_aarch64=('b9336b652c1233a07dea8eb4e864785e03c1d9706025768a19ac3b6646936539')
 sha256sums=('3c9f90350449325ae2b1355d6aae26df25be58f1cfcb8ed6a44b9c4b10c663f9')
 
 package() {
@@ -30,3 +22,4 @@
 
   install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
 }
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 13:30:33	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0