foxtune-bin

LOW

maintainer NullPointr 0 votes scanned 2026-09-25 00:03:36.779685

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release, which is a normal AUR practice; the source is verifiable and the checksum is provided, limiting supply-chain risk despite low votes and recent upload.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from a GitHub release, which is a normal AUR practice; the source is verifiable and the checksum is provided, limiting supply-chain risk despite low votes and recent upload.

PKGBUILD

      1# Maintainer: FoxTune contributors <niko.huuskonen.00@gmail.com>
    
      2#
    
      3# The AUR's foxtune-bin: the Linux tarball of a GitHub release, installed where
    
      4# the .deb and .rpm put it (see ../nfpm.yaml). .github/workflows/aur.yml
    
      5# publishes it when a release is published, and sets pkgver and the checksum
    
      6# then - see "Releasing" in BUILDING.md.
    
      7
    
      8pkgname=foxtune-bin
    
      9pkgver=0.1.0
    
      10pkgrel=1
    
      11pkgdesc='Open source ECU tuning for Speeduino and rusEFI'
    
      12arch=('x86_64')
    
      13url='https://github.com/N1kO23/FoxTune'
    
      14license=('GPL-3.0-only')
    
      15# What the bundle's binaries link against, by package.
    
      16depends=(
    
      17  'at-spi2-core' 'cairo' 'fontconfig' 'gdk-pixbuf2' 'glib2' 'glibc' 'gtk3'
    
      18  'harfbuzz' 'libepoxy' 'libgcc' 'libstdc++' 'pango' 'zlib'
    
      19)
    
      20optdepends=('xdg-desktop-portal: file dialogs, with the backend for your desktop')
    
      21provides=('foxtune')
    
      22conflicts=('foxtune')
    
      23# Prebuilt: stripping can damage the Dart snapshot in lib/libapp.so, and there
    
      24# are no debug symbols to split out.
    
      25options=('!strip' '!debug')
    
      26source=("$url/releases/download/v$pkgver/foxtune-linux-x64-$pkgver.tar.gz")
    
      27sha256sums=('6777d2a40e9f42a98b6f2ad8f881be9736e45841ba19cebb246693ab3ba877f6')
    
      28
    
      29package() {
    
      30  cd foxtune
    
      31
    
      32  # The bundle stays together: the executable finds its libraries and assets
    
      33  # beside itself, through the /usr/bin link too.
    
      34  install -d "$pkgdir/usr/lib/foxtune" "$pkgdir/usr/bin"
    
      35  cp -a --no-preserve=ownership foxtune lib data "$pkgdir/usr/lib/foxtune/"
    
      36  ln -s /usr/lib/foxtune/foxtune "$pkgdir/usr/bin/foxtune"
    
      37
    
      38  install -Dm644 data/com.foxtune.foxtune_app.desktop -t "$pkgdir/usr/share/applications"
    
      39  install -Dm644 data/com.foxtune.foxtune_app.metainfo.xml -t "$pkgdir/usr/share/metainfo"
    
      40  cp -a --no-preserve=ownership data/icons "$pkgdir/usr/share/"
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-25 00:03:36	Low	2
2026-09-24 23:44:46	Low	2