jarvis-bin

LOW

maintainer marmai 0 votes scanned 2026-08-19 13:41:59.633391

View on AUR

Why flagged

The package downloads a prebuilt binary and checksum from the project's official Git repository releases, which is a normal practice for binary packages; the source host is not whitelisted but plausibly legitimate, and the binary is installed without execution during build, posing low risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt binary and checksum from the project's official Git repository releases, which is a normal practice for binary packages; the source host is not whitelisted but plausibly legitimate, and the binary is installed without execution during build, posing low risk.

PKGBUILD

      1# Maintainer: Markus Maiwald <ops@sovereign-society.org>
    
      2# B-004 — binary package for Arch / CachyOS power users.
    
      3#
    
      4# Install (after publish to AUR, or local):
    
      5#   makepkg -si
    
      6#   jarvis doctor
    
      7#
    
      8# pkgver uses underscores (AUR forbids hyphens). Tag v0.3.0-beta.1 → 0.3.0_beta.1
    
      9
    
      10pkgname=jarvis-bin
    
      11pkgver=0.3.0_beta.87
    
      12pkgrel=1
    
      13pkgdesc="Jarvis — private AI agent for professionals (CE binary, static SQLite)"
    
      14arch=('x86_64')
    
      15url="https://git.sovereign-society.org/libertaria/Jarvis"
    
      16license=('LicenseRef-Libertaria')
    
      17depends=('glibc')
    
      18optdepends=(
    
      19  'podman: agent sandbox (recommended; default when healthy)'
    
      20)
    
      21provides=('jarvis' 'mnemos')
    
      22conflicts=('jarvis' 'mnemos' 'jarvis-git')
    
      23options=('!strip')  # already stripped in release build
    
      24# Map AUR pkgver → release tag / asset names
    
      25_tag="v0.3.0-beta.87"
    
      26_assetver="0.3.0-beta.87"
    
      27source=(
    
      28  "jarvis-${_assetver}-x86_64-linux.tar.gz::${url}/releases/download/${_tag}/jarvis-${_assetver}-x86_64-linux.tar.gz"
    
      29  "jarvis-${_assetver}-x86_64-linux.sha256::${url}/releases/download/${_tag}/jarvis-${_assetver}-x86_64-linux.sha256"
    
      30)
    
      31# sha256sums filled by updpkgsums after download; placeholder until first makepkg
    
      32sha256sums=(
    
      33  'db70fd849d140f6a5d394d317e2337fe9b146bed67c7cf47b7d2706192a705aa'
    
      34  'SKIP'
    
      35)
    
      36
    
      37package() {
    
      38  cd "${srcdir}/jarvis-${_assetver}-x86_64-linux"
    
      39
    
      40  install -Dm755 bin/jarvis "${pkgdir}/usr/bin/jarvis"
    
      41  install -Dm755 bin/harnessd "${pkgdir}/usr/bin/harnessd"
    
      42  ln -s jarvis "${pkgdir}/usr/bin/mnemos"
    
      43
    
      44  install -d "${pkgdir}/usr/share/jarvis"
    
      45  if [[ -d share ]]; then
    
      46    cp -a share/. "${pkgdir}/usr/share/jarvis/"
    
      47  fi
    
      48  if [[ -f VERSION ]]; then
    
      49    install -Dm644 VERSION "${pkgdir}/usr/share/jarvis/VERSION"
    
      50  fi
    
      51  if [[ -f README.txt ]]; then
    
      52    install -Dm644 README.txt "${pkgdir}/usr/share/doc/${pkgname}/README.txt"
    
      53  fi
    
      54}
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-19 13:41:59	Low	2