ganbaru-bin

MEDIUM

maintainer opengrimoire 0 votes scanned 2026-10-17 15:18:35.857371

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release without source compilation, creating a supply-chain risk if the release artifact is compromised, though it uses a verifiable checksum and originates from a project-owned repository.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a GitHub release without source compilation, creating a supply-chain risk if the release artifact is compromised, though it uses a verifiable checksum and originates from a project-owned repository.

PKGBUILD

      1# Maintainer: Victor Benito Garcia Rocha <victorbenitogr@gmail.com>
    
      2pkgname=ganbaru-bin
    
      3pkgver=0.1.10
    
      4pkgrel=1
    
      5pkgdesc="Local, privacy-first productivity app for reducing procrastination and burnout"
    
      6arch=('x86_64')
    
      7url="https://github.com/opengrimoire/ganbaru"
    
      8license=('AGPL-3.0-only')
    
      9depends=(
    
      10  'alsa-lib'
    
      11  'gtk3'
    
      12  'hicolor-icon-theme'
    
      13  'libayatana-appindicator'
    
      14  'webkit2gtk-4.1'
    
      15)
    
      16makedepends=('libarchive')
    
      17provides=('ganbaru')
    
      18conflicts=('ganbaru')
    
      19options=('!strip' '!debug')
    
      20source_x86_64=("ganbaru_${pkgver}_amd64.deb::https://github.com/opengrimoire/ganbaru/releases/download/app-v${pkgver}/ganbaru_${pkgver}_amd64.deb")
    
      21sha256sums_x86_64=('017a98e2da071be02359feee1301651b2117c35fa92c37d0b5be71a35094dbcb')
    
      22noextract=("ganbaru_${pkgver}_amd64.deb")
    
      23
    
      24prepare() {
    
      25  bsdtar -xf "ganbaru_${pkgver}_amd64.deb"
    
      26}
    
      27
    
      28package() {
    
      29  bsdtar -xf data.tar.* -C "$pkgdir"
    
      30
    
      31  rm -rf "$pkgdir/usr/lib/ganbaru/package-repo"
    
      32  rmdir "$pkgdir/usr/lib/ganbaru" 2>/dev/null || true
    
      33  rmdir "$pkgdir/usr/lib" 2>/dev/null || true
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 15:18:35	Medium	2