gety-bin

MEDIUM

maintainer Alex3236 1 votes scanned 2026-10-21 00:12:50.227280

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-standard host (dl.gety.ai), which is an unverifiable executable artifact from a swappable host, creating a supply-chain risk despite otherwise legitimate use.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 "gety-${pkgver}.deb::https://dl.gety.ai/Gety-linux-x64-${pkgver}-beta.deb"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a non-standard host (dl.gety.ai), which is an unverifiable executable artifact from a swappable host, creating a supply-chain risk despite otherwise legitimate use.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Alex3236 <me@alex3236.moe>
    
      2
    
      3pkgname=gety-bin
    
      4pkgver=0.6.2
    
      5pkgrel=1
    
      6pkgdesc="The local file search engine for you and your AI agents, made by Listary team"
    
      7arch=('x86_64')
    
      8url="https://gety.ai/"
    
      9license=('LicenseRef-Gety-ToS')
    
      10depends=(
    
      11    'cairo'
    
      12    'gcc-libs'
    
      13    'gdk-pixbuf2'
    
      14    'glib2'
    
      15    'glibc'
    
      16    'gtk3'
    
      17    'libayatana-appindicator'
    
      18    'libsoup3'
    
      19    'webkit2gtk-4.1'
    
      20)
    
      21provides=('gety')
    
      22conflicts=('gety' 'gety-appimage')
    
      23options=('!strip')
    
      24source=(
    
      25    "gety-${pkgver}.deb::https://dl.gety.ai/Gety-linux-x64-${pkgver}-beta.deb"
    
      26    "gety-license.txt"
    
      27)
    
      28sha256sums=('d0578200f483e19965c3c866d04daaf5f8a396acb61ae94ad34acf62cae01c8c'
    
      29            'fe5811b6741770c6dded6256176f4a71bdf2918541a1191767484984e810172e')
    
      30
    
      31package() {
    
      32    cd "$srcdir"
    
      33    rm -rf deb
    
      34    mkdir -p deb/root
    
      35    cd deb
    
      36    ar x "$srcdir/gety-${pkgver}.deb"
    
      37    tar -xzf data.tar.gz -C root
    
      38
    
      39    # 0.6.2 resolves its helpers relative to the executable
    
      40    # (<exedir>/../lib/gety/), so the deb layout installs as-is:
    
      41    #   /usr/bin/gety
    
      42    #   /usr/lib/gety/{deno,aria2c,mcp-proxy,gety-reporter}
    
      43    #   /usr/lib/Gety/{lib,resources}
    
      44    # No /usr/bin pollution, hence no bwrap wrapper needed (<=0.5.7 did).
    
      45    cp -a root/usr "$pkgdir/"
    
      46
    
      47    # Gety ships no license text; distribute the terms snapshot from gety.ai
    
      48    # (maintained in this repo as gety-license.txt, like google-chrome's
    
      49    # eula_text.html). Refresh it manually when upstream terms change.
    
      50    install -Dm644 "$srcdir/gety-license.txt" \
    
      51        "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      52}

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2
2026-10-12 00:18:51	Medium	2
2026-10-11 00:26:05	Medium	2
2026-10-10 00:11:52	Medium	2
2026-10-09 00:05:33	Medium	2
2026-10-08 00:28:03	Medium	2
2026-10-07 00:21:34	Medium	2
2026-10-06 00:13:36	Medium	2
2026-10-05 00:08:03	Medium	2
2026-10-04 00:18:08	Medium	2
2026-10-03 00:23:04	Medium	2
2026-10-02 00:00:32	Medium	2