gety-bin

MEDIUM

maintainer Alex3236 1 votes scanned 2026-09-06 09:13:56.100282

View on AUR

Why flagged

Installs a prebuilt binary .deb (including bundled deno, aria2c, mcp-proxy executables) from dl.gety.ai, which is the project's own official download domain but is a non-whitelisted host serving unverifiable prebuilt binaries; checksums are provided so integrity is verifiable, but the bundled executables (especially deno and mcp-proxy) run with broad system access and the package is new with few votes, making supply-chain risk non-trivial.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 "gety-${pkgver}.deb::https://dl.gety.ai/Gety-linux-x64-${pkgver}-beta.deb"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs a prebuilt binary .deb (including bundled deno, aria2c, mcp-proxy executables) from dl.gety.ai, which is the project's own official download domain but is a non-whitelisted host serving unverifiable prebuilt binaries; checksums are provided so integrity is verifiable, but the bundled executables (especially deno and mcp-proxy) run with broad system access and the package is new with few votes, making supply-chain risk non-trivial.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Alex3236 <me@alex3236.moe>
    
      2
    
      3pkgname=gety-bin
    
      4pkgver=0.5.7
    
      5pkgrel=1
    
      6pkgdesc="The local file search engine for you and your AI agents, made by Listary team"
    
      7arch=('x86_64')
    
      8url="https://gety.ai/"
    
      9license=('LicenseRef-Gety-ToS')
    
      10depends=(
    
      11    'bubblewrap'
    
      12    'cairo'
    
      13    'gcc-libs'
    
      14    'gdk-pixbuf2'
    
      15    'glib2'
    
      16    'glibc'
    
      17    'gtk3'
    
      18    'libayatana-appindicator'
    
      19    'libsoup3'
    
      20    'webkit2gtk-4.1'
    
      21)
    
      22provides=('gety')
    
      23conflicts=('gety' 'gety-appimage')
    
      24options=('!strip')
    
      25source=(
    
      26    "gety-${pkgver}.deb::https://dl.gety.ai/Gety-linux-x64-${pkgver}-beta.deb"
    
      27    "gety-license.txt"
    
      28)
    
      29sha256sums=('4c74dd34fba3b0c275bf589b1b42a23b99a6cbb6e3fcd4120f2973bab749b355'
    
      30            'fe5811b6741770c6dded6256176f4a71bdf2918541a1191767484984e810172e')
    
      31
    
      32package() {
    
      33    cd "$srcdir"
    
      34    rm -rf deb
    
      35    mkdir -p deb/root
    
      36    cd deb
    
      37    ar x "$srcdir/gety-${pkgver}.deb"
    
      38    tar -xzf data.tar.gz -C root
    
      39
    
      40    # Keep Gety's expected main executable and resource paths.
    
      41    install -Dm755 root/usr/bin/Gety "$pkgdir/usr/bin/Gety"
    
      42    install -dm755 "$pkgdir/usr/lib/Gety/bin"
    
      43    install -Dm755 root/usr/bin/deno "$pkgdir/usr/lib/Gety/bin/deno"
    
      44    install -Dm755 root/usr/bin/aria2c "$pkgdir/usr/lib/Gety/bin/aria2c"
    
      45    install -Dm755 root/usr/bin/mcp-proxy "$pkgdir/usr/lib/Gety/bin/mcp-proxy"
    
      46    install -Dm755 root/usr/bin/gety-reporter "$pkgdir/usr/lib/Gety/bin/gety-reporter"
    
      47    cp -a root/usr/lib/Gety/. "$pkgdir/usr/lib/Gety/"
    
      48
    
      49    # Map bundled helpers into /usr/bin only inside Gety's mount namespace.
    
      50    install -Dm755 /dev/stdin "$pkgdir/usr/bin/gety" <<'EOF'
    
      51#!/bin/sh
    
      52
    
      53exec bwrap \
    
      54    --ro-bind / / \
    
      55    --bind "$HOME" "$HOME" \
    
      56    --tmpfs /tmp \
    
      57    --ro-bind-try /tmp/.X11-unix /tmp/.X11-unix \
    
      58    --bind "/run/user/$(id -u)" "/run/user/$(id -u)" \
    
      59    --dev-bind /dev /dev \
    
      60    --overlay-src /usr/bin \
    
      61    --tmp-overlay /usr/bin \
    
      62    --ro-bind /usr/lib/Gety/bin/deno /usr/bin/deno \
    
      63    --ro-bind /usr/lib/Gety/bin/aria2c /usr/bin/aria2c \
    
      64    --ro-bind /usr/lib/Gety/bin/mcp-proxy /usr/bin/mcp-proxy \
    
      65    --ro-bind /usr/lib/Gety/bin/gety-reporter /usr/bin/gety-reporter \
    
      66    --setenv PATH "/usr/lib/Gety/bin${PATH:+:$PATH}" \
    
      67    /usr/bin/Gety "$@"
    
      68EOF
    
      69
    
      70    install -Dm644 root/usr/share/applications/Gety.desktop \
    
      71        "$pkgdir/usr/share/applications/gety.desktop"
    
      72    sed -i 's/^Exec=Gety$/Exec=gety/' "$pkgdir/usr/share/applications/gety.desktop"
    
      73    sed -i '/^Comment=/d; /^Name=Gety$/a Comment=The local file search engine for you and your AI agents' \
    
      74        "$pkgdir/usr/share/applications/gety.desktop"
    
      75
    
      76    install -Dm644 root/usr/share/icons/hicolor/32x32/apps/Gety.png \
    
      77        "$pkgdir/usr/share/icons/hicolor/32x32/apps/Gety.png"
    
      78    install -Dm644 root/usr/share/icons/hicolor/128x128/apps/Gety.png \
    
      79        "$pkgdir/usr/share/icons/hicolor/128x128/apps/Gety.png"
    
      80    install -Dm644 root/usr/share/icons/hicolor/256x256@2/apps/Gety.png \
    
      81        "$pkgdir/usr/share/icons/hicolor/256x256@2/apps/Gety.png"
    
      82
    
      83    # Gety ships no license text; distribute the terms snapshot from gety.ai
    
      84    # (maintained in this repo as gety-license.txt, like google-chrome's
    
      85    # eula_text.html). Refresh it manually when upstream terms change.
    
      86    install -Dm644 "$srcdir/gety-license.txt" \
    
      87        "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      88}
    
      89

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-06 09:13:56	Medium	3
2026-09-06 09:10:50	Medium	3