glean-bin

LOW

maintainer rokuroo 0 votes scanned 2026-08-31 15:45:42.143005

View on AUR

Why flagged

The package downloads a prebuilt binary from a GitHub release and extracts a payload marked by a sentinel line; while the host is not whitelisted, it is the project's own repository, and the binary is installed directly without obfuscation or remote code execution, limiting risk to typical supply-chain concerns for self-hosted binaries.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt binary from a GitHub release and extracts a payload marked by a sentinel line; while the host is not whitelisted, it is the project's own repository, and the binary is installed directly without obfuscation or remote code execution, limiting risk to typical supply-chain concerns for self-hosted binaries.

PKGBUILD

      1# Maintainer: rokuroo171 <rokuroo171 at github dot com>
    
      2
    
      3pkgname=glean-bin
    
      4pkgver=1.5.0
    
      5pkgrel=1
    
      6pkgdesc="A note-taking app with a night-sky canvas"
    
      7arch=('x86_64')
    
      8url="https://github.com/rokuroo171/glean"
    
      9license=('GPL-3.0-or-later')
    
      10provides=('glean')
    
      11conflicts=('glean')
    
      12options=(!strip)
    
      13depends=('webkit2gtk-4.1' 'gtk3')
    
      14optdepends=('libappindicator-gtk3: system tray support')
    
      15source=("$url/releases/download/v$pkgver/glean-desktop"
    
      16  "$url/raw/v$pkgver/LICENSE")
    
      17sha256sums=('0434e1eb119a0cd58f8f73ec8e5428d5259c0eeeafe9f71969aa9f21be49ba20'
    
      18            '3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986')
    
      19
    
      20prepare() {
    
      21  LINE=$(awk '/^__GLEAN_ARCHIVE__$/{ print NR; exit }' "$srcdir/glean-desktop")
    
      22  if [ -z "$LINE" ]; then
    
      23    echo "glean-desktop: corrupt bundle (payload marker not found)" >&2
    
      24    return 1
    
      25  fi
    
      26  tail -n +"$((LINE + 1))" "$srcdir/glean-desktop" | tar -xzf - -C "$srcdir"
    
      27}
    
      28
    
      29package() {
    
      30  install -Dm755 "$srcdir/glean" "$pkgdir/usr/bin/glean"
    
      31  install -Dm644 "$srcdir/glean.png" \
    
      32    "$pkgdir/usr/share/icons/hicolor/512x512/apps/glean.png"
    
      33  install -Dm644 "$srcdir/glean.desktop" \
    
      34    "$pkgdir/usr/share/applications/glean.desktop"
    
      35  install -Dm644 "$srcdir/LICENSE" \
    
      36    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-31 15:45:42	Low	2