gama-bin

MEDIUM

maintainer pineappletoad 0 votes scanned 2026-09-02 15:51:02.635429

View on AUR

Why flagged

The package installs a precompiled binary from a personal GitHub release, which is an unverifiable executable with supply-chain risk if the source were swapped.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a precompiled binary from a personal GitHub release, which is an unverifiable executable with supply-chain risk if the source were swapped.

PKGBUILD

      1# Maintainer: piratecarrot
    
      2
    
      3pkgname=gama-bin
    
      4pkgver=2.33
    
      5_pkgrel_src=1
    
      6pkgrel=1
    
      7pkgdesc="Package dedicated to the adjustment of surveying networks. (precompiled)"
    
      8arch=('x86_64')
    
      9url="https://www.gnu.org/software/gama/"
    
      10license=('GPL-3.0-or-later')
    
      11provides=('gama')
    
      12conflicts=('gama')
    
      13depends=('expat' 'glibc' 'sqlite' 'gcc-libs')
    
      14
    
      15source=("https://github.com/tubbywrestler/gama-bin/releases/download/${pkgver}-${_pkgrel_src}/gama-${pkgver}-${_pkgrel_src}-x86_64.pkg.tar.zst")
    
      16sha256sums=('5eddaa2ef59502fb03342bf747429286adf364d1b1418b1c4a9e005a9a15be34')
    
      17
    
      18package() {
    
      19    bsdtar -xf "${srcdir}/gama-${pkgver}-${_pkgrel_src}-x86_64.pkg.tar.zst" -C "${pkgdir}" --exclude .PKGINFO --exclude .BUILDINFO --exclude .MTREE
    
      20}
    
      21

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-02 15:51:02	Medium	2