gaze-bin

LOW

maintainer GunduLabs 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package installs a prebuilt package from a project-owned domain (packages.gundulabs.com), which is not on standard AUR whitelists but plausibly legitimate; the source is verified via checksum and the package only wraps and installs its own files, with no evidence of remote code execution or malicious behavior.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs a prebuilt package from a project-owned domain (packages.gundulabs.com), which is not on standard AUR whitelists but plausibly legitimate; the source is verified via checksum and the package only wraps and installs its own files, with no evidence of remote code execution or malicious behavior.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("gaze-0.4.1-1-x86_64.pkg.tar.zst::https://packages.gundulabs.com/arch/packages/gaze-0.4.1-1-x86_64.pkg.tar.zst")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Gundu Labs <maintainers@gundulabs.com>
    
      2# Auto-generated by the packages publish script (build_aur_repo.sh). Do not edit manually.
    
      3pkgname=gaze-bin
    
      4pkgver=0.4.1
    
      5pkgrel=1
    
      6pkgdesc="Daemon, CLI, and PAM integration for Gaze"
    
      7arch=('x86_64' )
    
      8url="https://gaze.gundulabs.com"
    
      9license=('GPL-3.0-or-later' )
    
      10depends=('gst-plugin-pipewire' 'gst-plugins-base' 'gst-plugins-good' 'opencv<5.1' 'opencv>=5.0' 'pam' 'tpm2-tss' )
    
      11optdepends=()
    
      12# This wrapper installs the same files under the same names as gaze, so it has
    
      13# to claim that name. Without it an AUR helper treats any other package called
    
      14# gaze as an upgrade candidate and silently replaces this one.
    
      15provides=('gaze=0.4.1-1')
    
      16conflicts=('gaze')
    
      17backup=('etc/dbus-1/system.d/com.gundulabs.Gaze.conf' 'etc/gaze/config.toml' )
    
      18install='gaze-bin.install'
    
      19source=("gaze-0.4.1-1-x86_64.pkg.tar.zst::https://packages.gundulabs.com/arch/packages/gaze-0.4.1-1-x86_64.pkg.tar.zst")
    
      20sha256sums=('9ae14fc96772621112179ed53818d4d434bc015f6606a3e05ecc3470b0ff6c25')
    
      21
    
      22package() {
    
      23  bsdtar -xpf "$srcdir/gaze-0.4.1-1-x86_64.pkg.tar.zst" -C "$pkgdir"
    
      24  # .PKGINFO/.MTREE/.INSTALL are pacman's metadata for the inner package and must not
    
      25  # land in $pkgdir. The hooks .INSTALL carries are re-declared through install= above,
    
      26  # which is the only way makepkg runs them for a wrapper package.
    
      27  find "$pkgdir" -maxdepth 1 -type f -name '.*' -delete
    
      28}
    
      29

Changes since previous scan

--- PKGBUILD @ 2026-10-26 00:12
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
 # Maintainer: Gundu Labs <maintainers@gundulabs.com>
 # Auto-generated by the packages publish script (build_aur_repo.sh). Do not edit manually.
 pkgname=gaze-bin
-pkgver=0.4.0
+pkgver=0.4.1
 pkgrel=1
 pkgdesc="Daemon, CLI, and PAM integration for Gaze"
 arch=('x86_64' )
@@ -12,15 +12,15 @@
 # This wrapper installs the same files under the same names as gaze, so it has
 # to claim that name. Without it an AUR helper treats any other package called
 # gaze as an upgrade candidate and silently replaces this one.
-provides=('gaze=0.4.0-1')
+provides=('gaze=0.4.1-1')
 conflicts=('gaze')
 backup=('etc/dbus-1/system.d/com.gundulabs.Gaze.conf' 'etc/gaze/config.toml' )
 install='gaze-bin.install'
-source=("gaze-0.4.0-1-x86_64.pkg.tar.zst::https://packages.gundulabs.com/arch/packages/gaze-0.4.0-1-x86_64.pkg.tar.zst")
-sha256sums=('f7cf549b0d3ca0f4b5ccf92e0f719e415c3768071e18bf59a1b3ec8b88a424b9')
+source=("gaze-0.4.1-1-x86_64.pkg.tar.zst::https://packages.gundulabs.com/arch/packages/gaze-0.4.1-1-x86_64.pkg.tar.zst")
+sha256sums=('9ae14fc96772621112179ed53818d4d434bc015f6606a3e05ecc3470b0ff6c25')
 
 package() {
-  bsdtar -xpf "$srcdir/gaze-0.4.0-1-x86_64.pkg.tar.zst" -C "$pkgdir"
+  bsdtar -xpf "$srcdir/gaze-0.4.1-1-x86_64.pkg.tar.zst" -C "$pkgdir"
   # .PKGINFO/.MTREE/.INSTALL are pacman's metadata for the inner package and must not
   # land in $pkgdir. The hooks .INSTALL carries are re-declared through install= above,
   # which is the only way makepkg runs them for a wrapper package.

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 11:44:54	Medium	1
2026-10-26 00:12:40	Medium	2
2026-10-25 01:41:32	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2