jorvik-bin

LOW

maintainer Xuruh 0 votes scanned 2026-09-23 03:39:22.340916

View on AUR

Why flagged

The package installs a prebuilt .deb from the project's official GitHub releases, which is unpacked and installed directly; while the source is not built from scratch, it comes from the official project repository and poses no active execution or obfuscation risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt .deb from the project's official GitHub releases, which is unpacked and installed directly; while the source is not built from scratch, it comes from the official project repository and poses no active execution or obfuscation risk.

PKGBUILD

      1# Maintainer: Xuruh <admin@jorvik.app>
    
      2
    
      3pkgname=jorvik-bin
    
      4_pkgname=jorvik
    
      5pkgver=1.0.8
    
      6pkgrel=1
    
      7pkgdesc="Self-hosted Matrix client built to feel like Discord"
    
      8arch=('x86_64')
    
      9url="https://github.com/jorvikapp/jorvik"
    
      10license=('AGPL-3.0-only')
    
      11# Translated from the upstream .deb's Depends. libuuid1 is util-linux-libs on
    
      12# Arch, and libxss1/libxtst6 are libxss/libxtst.
    
      13depends=('gtk3' 'nss' 'libnotify' 'libxss' 'libxtst' 'at-spi2-core' 'libsecret'
    
      14         'util-linux-libs' 'xdg-utils')
    
      15optdepends=('libappindicator-gtk3: tray icon on desktops using AppIndicator')
    
      16provides=("$_pkgname=$pkgver")
    
      17conflicts=("$_pkgname")
    
      18options=('!strip' '!debug')
    
      19install="$pkgname.install"
    
      20source=("$_pkgname-$pkgver.deb::$url/releases/download/v$pkgver/Jorvik-$pkgver.deb")
    
      21sha256sums=('d5449357b335bcdd6ef7f56ccef40a704a002fd556c0dc2642eb6ec449d4e1ef')
    
      22# makepkg does not understand .deb, so unpack it by hand in package().
    
      23noextract=("$_pkgname-$pkgver.deb")
    
      24
    
      25package() {
    
      26    bsdtar -xf "$_pkgname-$pkgver.deb" -C "$srcdir" data.tar.xz
    
      27    bsdtar -xf "$srcdir/data.tar.xz" -C "$pkgdir"
    
      28
    
      29    # Upstream ships the launcher only under /opt; Debian's postinst makes this
    
      30    # symlink through update-alternatives, which Arch has no equivalent for.
    
      31    install -dm755 "$pkgdir/usr/bin"
    
      32    ln -sf /opt/Jorvik/jorvik "$pkgdir/usr/bin/$_pkgname"
    
      33
    
      34    # A Debian changelog is not something an Arch package should carry.
    
      35    rm -rf "$pkgdir/usr/share/doc"
    
      36
    
      37    # Electron's setuid sandbox helper. Left 0755 here and fixed in .install,
    
      38    # because a setuid bit inside a package is a footgun if the file is ever
    
      39    # replaced; see the comment there.
    
      40    chmod 0755 "$pkgdir/opt/Jorvik/chrome-sandbox"
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-23 03:39:22	Low	2
2026-09-23 01:39:21	Low	2