g0v0-robin-bin

MEDIUM

maintainer MingxuanGame 0 votes scanned 2026-10-29 05:51:59.620878

View on AUR

Why flagged

The package installs prebuilt AppImages from GitHub Releases, which are unverifiable executables; if the source were swapped, it could lead to arbitrary code execution, though the host (github.com) is legitimate and the project appears to be the official one.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs prebuilt AppImages from GitHub Releases, which are unverifiable executables; if the source were swapped, it could lead to arbitrary code execution, though the host (github.com) is legitimate and the project appears to be the official one.

PKGBUILD

      1# Maintainer: MingxuanGame <MingxuanGame@outlook.com>
    
      2
    
      3pkgname=g0v0-robin-bin
    
      4_pkgname=${pkgname%-bin}
    
      5pkgver=2026.1022.1
    
      6_pkgtag=v${pkgver}-g0v0
    
      7pkgrel=2
    
      8pkgdesc="g0v0! -- free and open rhythm experience! (Robin pre-release channel)"
    
      9arch=(x86_64 aarch64)
    
      10url="https://github.com/GooGuTeam/g0v0"
    
      11license=("MIT" "custom:CC-BY-NC 4.0")
    
      12depends=(
    
      13  zlib
    
      14  libgl
    
      15  fuse2
    
      16  osu-mime
    
      17)
    
      18provides=(g0v0)
    
      19conflicts=(g0v0 g0v0-bin g0v0-robin g0v0-git)
    
      20options=(!strip !debug)
    
      21source=(
    
      22  "icon.png"
    
      23  "https://raw.githubusercontent.com/GooGuTeam/g0v0-resources/master/LICENCE.md"
    
      24  "g0v0.desktop"
    
      25  "g0v0-uri-handler.desktop"
    
      26  "g0v0"
    
      27)
    
      28noextract=("${_pkgname}-${_pkgtag}-x86_64.AppImage" "${_pkgname}-${_pkgtag}-aarch64.AppImage")
    
      29source_x86_64=(
    
      30  "${_pkgname}-${_pkgtag}-x86_64.AppImage::https://github.com/GooGuTeam/g0v0/releases/download/${_pkgtag}/g0v0.AppImage"
    
      31)
    
      32source_aarch64=(
    
      33  "${_pkgname}-${_pkgtag}-aarch64.AppImage::https://github.com/GooGuTeam/g0v0/releases/download/${_pkgtag}/g0v0-arm64.AppImage"
    
      34)
    
      35sha256sums=('c93f6981c6c528e717d5215eeed775cf4926fe61476d95163b3ecd5770f40dda'
    
      36            '96276add86bd921e64255ce7e5487599dbe13e6e48e96a6af1a58cc99c187648'
    
      37            '26ecc3e357b03798cd8cc4ada4348d9e8eef1f3c725f8176e3b9533185c0bd0a'
    
      38            'dfbe774cb090a23f4000859dd9bb6c79717e20d091737893b915a55db5b4965a'
    
      39            '437545915242c3284ed8da47e125d37f63b416e3edff8c9bf4ce7d79a007bd59')
    
      40sha256sums_x86_64=('da91491dcc5979e8f79156f11cfa92ed90ceee66b5763a882633ee0db44cc809')
    
      41sha256sums_aarch64=('04b801ef0de88b679dcf5141a075cd5219c2531454345f51dfd971bb894d07e8')
    
      42
    
      43package() {
    
      44  cd "$srcdir"
    
      45
    
      46  install -Dm755 "${_pkgname}-${_pkgtag}-${CARCH}.AppImage" "$pkgdir/opt/g0v0/g0v0.AppImage"
    
      47  install -Dm755 -t "$pkgdir/usr/bin" g0v0
    
      48  install -Dm644 icon.png "$pkgdir/usr/share/pixmaps/g0v0.png"
    
      49  install -Dm644 -t "$pkgdir/usr/share/applications" g0v0.desktop
    
      50  install -Dm644 -t "$pkgdir/usr/share/applications" g0v0-uri-handler.desktop
    
      51  install -Dm644 -t "$pkgdir/usr/share/licenses/$pkgname" LICENCE.md
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-29 05:51:59	Medium	2