grimodex-bin

maintainer kazormia296 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package re-packages a prebuilt .deb binary from GitHub Releases without compiling from source, creating a supply-chain risk if the release artifact is swapped, though the source is plausibly the project's own.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package re-packages a prebuilt .deb binary from GitHub Releases without compiling from source, creating a supply-chain risk if the release artifact is swapped, though the source is plausibly the project's own.

PKGBUILD

      1# Maintainer: kazormia296 <kazormia296@users.noreply.github.com>
    
      2#
    
      3# Grimodex の Arch Linux バイナリパッケージ。
    
      4# GitHub Releases の Electron .deb (ubuntu-24.04 ビルド) を再パッケージする。
    
      5# このファイルはテンプレートで、pkgver=@PKGVER@ を CI が実バージョンへ置換する:
    
      6#   - release.yml の build-arch ジョブ (ローカルの .deb を使い .pkg.tar.zst を生成)
    
      7#   - aur-publish.yml (リリース公開時に AUR の grimodex-bin を更新)
    
      8# 詳細は packaging/arch/README.md を参照。
    
      9
    
      10pkgname=grimodex-bin
    
      11pkgver=2.0.9
    
      12pkgrel=1
    
      13pkgdesc="AI-integrated novel writing editor (Electron + React)"
    
      14arch=('x86_64')
    
      15url="https://github.com/kazormia296/Grimodex"
    
      16license=('Elastic-2.0')
    
      17# electron-builder 26 の deb 既定dependsを Arch のパッケージ名へ対応させ、
    
      18# legacy keyring migration用の libsecret / dbus も明示する。WebKitGTKは不要。
    
      19depends=('glibc' 'gcc-libs' 'gtk3' 'libnotify' 'nss' 'libxss' 'libxtst' 'xdg-utils' 'at-spi2-core' 'util-linux-libs' 'libsecret' 'dbus' 'hicolor-icon-theme')
    
      20provides=('grimodex')
    
      21conflicts=('grimodex')
    
      22# ビルド済みバイナリの再パッケージなので strip / debug 分離はしない
    
      23options=('!strip' '!debug')
    
      24# Elastic-2.0 は Arch の common license 外なのでライセンス本文の同梱が必須 (namcap E)。
    
      25# バージョン付き名で保存し、SRCDEST キャッシュの stale 化を防ぐ。
    
      26source=("LICENSE-v${pkgver}::https://raw.githubusercontent.com/kazormia296/Grimodex/v${pkgver}/LICENSE")
    
      27source_x86_64=("${url}/releases/download/v${pkgver}/Grimodex-${pkgver}-linux-amd64.deb")
    
      28sha256sums=('0e90de829ce8a918b0c934e241c4f68bd49c3d0aef55649b78d6d38a64c87f85')
    
      29sha256sums_x86_64=('85aac28e7285f8d29344154e28f5c4b0c5cc0847ad9e52ff6e3b7c399de5ebb3')
    
      30
    
      31package() {
    
      32  # makepkg が .deb (ar アーカイブ) を srcdir へ自動展開済み。
    
      33  # 中身の data.tar.* (usr/bin, usr/share, opt/Grimodex/resources) を
    
      34  # そのまま pkgdir へ展開する。
    
      35  bsdtar -xf "${srcdir}"/data.tar.* -C "${pkgdir}"
    
      36  # Debian postinst は /usr/bin link と sandbox mode を作るが、再pack時は
    
      37  # control archiveを使わないためpayload側で同じ起動契約を明示する。
    
      38  install -d "${pkgdir}/usr/bin"
    
      39  ln -s '/opt/Grimodex/grimodex' "${pkgdir}/usr/bin/grimodex"
    
      40  chmod 0755 "${pkgdir}/opt/Grimodex/chrome-sandbox"
    
      41  # .deb内の resources/package-type=deb をElectron updaterに使わせない。
    
      42  # Arch/AURはpacman経由で更新し、mainはこのmarkerを見て内蔵更新を無効化する。
    
      43  printf 'arch\n' > \
    
      44    "${pkgdir}/opt/Grimodex/resources/grimodex-package-channel"
    
      45  install -Dm644 "${srcdir}/LICENSE-v${pkgver}" \
    
      46    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      47}
    
      48

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -8,7 +8,7 @@
 # 詳細は packaging/arch/README.md を参照。
 
 pkgname=grimodex-bin
-pkgver=2.0.8
+pkgver=2.0.9
 pkgrel=1
 pkgdesc="AI-integrated novel writing editor (Electron + React)"
 arch=('x86_64')
@@ -26,7 +26,7 @@
 source=("LICENSE-v${pkgver}::https://raw.githubusercontent.com/kazormia296/Grimodex/v${pkgver}/LICENSE")
 source_x86_64=("${url}/releases/download/v${pkgver}/Grimodex-${pkgver}-linux-amd64.deb")
 sha256sums=('0e90de829ce8a918b0c934e241c4f68bd49c3d0aef55649b78d6d38a64c87f85')
-sha256sums_x86_64=('594a725185fd49310ef2e4375e55d801a2195a0cb0b6a5bde06ad1f4b40503b7')
+sha256sums_x86_64=('85aac28e7285f8d29344154e28f5c4b0c5cc0847ad9e52ff6e3b7c399de5ebb3')
 
 package() {
   # makepkg が .deb (ar アーカイブ) を srcdir へ自動展開済み。

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 11:17:50	MEDIUM	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 15:32:35	LOW	2
2026-07-26 09:32:02	LOW	2