glyph-ocr-bin
MEDIUM
maintainer sid-lakhani
0 votes
scanned 2026-11-03 10:04:25.157601
Why flagged
The package installs a precompiled binary from a GitHub release without verifiable checksums (sha256sums='SKIP'), creating a supply-chain risk if the source were tampered with.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Medium
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a precompiled binary from a GitHub release without verifiable checksums (sha256sums='SKIP'), creating a supply-chain risk if the source were tampered with.
PKGBUILD
1
# Maintainer: Siddhesh Lakhani <lakhani.siddhesh@gmail.com>
2
pkgname=glyph-ocr-bin
3
_pkgname=glyph
4
pkgver=0.1.1
5
pkgrel=1
6
pkgdesc="Blazing-fast, minimal Wayland screen OCR & text sniper (precompiled binary)"
7
arch=('x86_64')
8
url="https://github.com/sid-lakhani/glyph"
9
license=('MIT')
10
depends=('slurp' 'grim' 'wl-clipboard')
11
optdepends=(
12
'tesseract: Full OCR text recognition'
13
'tesseract-data-eng: English OCR language training dataset'
14
)
15
provides=('glyph' 'glyph-ocr')
16
conflicts=('glyph' 'glyph-ocr')
17
source=("$pkgname-$pkgver.tar.gz::$url/releases/download/v$pkgver/glyph-v$pkgver-x86_64-unknown-linux-gnu.tar.gz")
18
sha256sums=('SKIP')
19
20
package() {
21
cd "glyph-v$pkgver-x86_64-unknown-linux-gnu"
22
install -Dm755 "$_pkgname" "$pkgdir/usr/bin/$_pkgname"
23
if [ -f LICENSE ]; then
24
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
25
fi
26
}
27
28
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-03 10:04:25 | Medium | 2 |