koreader-nightly-bin

maintainer atharva-potdar · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt .deb files from the project's official build infrastructure (build.koreader.rocks), which is plausibly controlled by the project; checksums are provided and the payload is not obfuscated, making this a standard binary package with normal supply-chain risk for AUR.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt .deb files from the project's official build infrastructure (build.koreader.rocks), which is plausibly controlled by the project; checksums are provided and the payload is not obfuscated, making this a standard binary package with normal supply-chain risk for AUR.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source_x86_64=("koreader-nightly-x86_64-${pkgver}.deb::https://build.koreader.rocks/download/nightly/${_realver}/koreader_${_realver}-1_amd64.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Atharva Potdar <atharvapotdar07@gmail.com>
    
      2
    
      3pkgname=koreader-nightly-bin
    
      4pkgver=2026.07_7_g9192014d8
    
      5_realver=2026.07-7-g9192014d8
    
      6pkgrel=1
    
      7pkgdesc="An ebook reader application supporting PDF, DjVu, EPUB, FB2 and many more formats (Nightly Build)"
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://github.com/koreader/koreader/"
    
      10license=('AGPL3')
    
      11
    
      12provides=('koreader')
    
      13conflicts=('koreader' 'koreader-bin')
    
      14
    
      15depends=('sdl3' 'noto-fonts' 'ttf-droid')
    
      16options=('!strip' '!debug')
    
      17
    
      18source_x86_64=("koreader-nightly-x86_64-${pkgver}.deb::https://build.koreader.rocks/download/nightly/${_realver}/koreader_${_realver}-1_amd64.deb")
    
      19source_aarch64=("koreader-nightly-aarch64-${pkgver}.deb::https://build.koreader.rocks/download/nightly/${_realver}/koreader_${_realver}-1_arm64.deb")
    
      20
    
      21sha256sums_x86_64=('38a39b4b06db5c06c61435703eb198058ff16c95ada5fa8fc79dd9d127add224')
    
      22sha256sums_aarch64=('c5d15ea1abfc992fa3b6fc0ddb40c98055e85bbf367df5c9dff45191706f404f')
    
      23
    
      24prepare() {
    
      25  rm -rf "${srcdir}/dpkgdir"
    
      26  mkdir -p "${srcdir}/dpkgdir"
    
      27
    
      28  cd "${srcdir}"
    
      29
    
      30  ar x "koreader-nightly-${CARCH}-${pkgver}.deb"
    
      31
    
      32  DATA_ARCHIVE=$(ls data.tar.*)
    
      33  tar -xf "$DATA_ARCHIVE" -C "${srcdir}/dpkgdir"
    
      34}
    
      35
    
      36package() {
    
      37  cp -r "${srcdir}/dpkgdir"/* "${pkgdir}"
    
      38}
    
      39

Changes since previous scan

--- PKGBUILD @ 2026-08-01 00:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,8 +1,8 @@
 # Maintainer: Atharva Potdar <atharvapotdar07@gmail.com>
 
 pkgname=koreader-nightly-bin
-pkgver=2026.07_5_g574fe9f6e
-_realver=2026.07-5-g574fe9f6e
+pkgver=2026.07_7_g9192014d8
+_realver=2026.07-7-g9192014d8
 pkgrel=1
 pkgdesc="An ebook reader application supporting PDF, DjVu, EPUB, FB2 and many more formats (Nightly Build)"
 arch=('x86_64' 'aarch64')
@@ -18,8 +18,8 @@
 source_x86_64=("koreader-nightly-x86_64-${pkgver}.deb::https://build.koreader.rocks/download/nightly/${_realver}/koreader_${_realver}-1_amd64.deb")
 source_aarch64=("koreader-nightly-aarch64-${pkgver}.deb::https://build.koreader.rocks/download/nightly/${_realver}/koreader_${_realver}-1_arm64.deb")
 
-sha256sums_x86_64=('50940c9b92840b9599c7b3c0be8643d919fae2cd14eeac82e0c87316c38f7a16')
-sha256sums_aarch64=('0c16682346e610a440ebac25791f0e341a0d65af9c78e9f347ef83242cbab860')
+sha256sums_x86_64=('38a39b4b06db5c06c61435703eb198058ff16c95ada5fa8fc79dd9d127add224')
+sha256sums_aarch64=('c5d15ea1abfc992fa3b6fc0ddb40c98055e85bbf367df5c9dff45191706f404f')
 
 prepare() {
   rm -rf "${srcdir}/dpkgdir"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 09:20:18	MEDIUM	1
2026-08-01 00:11:18	LOW	2
2026-07-31 09:17:30	MEDIUM	1
2026-07-31 00:14:10	LOW	2
2026-07-30 09:14:07	MEDIUM	1
2026-07-30 00:17:23	LOW	2
2026-07-29 09:11:06	MEDIUM	1
2026-07-29 00:25:53	LOW	2
2026-07-28 09:37:42	MEDIUM	1
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 09:32:02	MEDIUM	1
2026-07-26 00:07:32	LOW	2
2026-07-25 09:29:42	MEDIUM	1
2026-07-25 00:13:44	LOW	2
2026-07-24 09:27:42	MEDIUM	1
2026-07-24 00:02:28	CLEAN	2
2026-07-23 09:22:54	MEDIUM	1