leafsmith-bin

LOW

maintainer Firstpick 0 votes scanned 2026-10-19 00:03:55.276608

View on AUR

Why flagged

Package installs a prebuilt AppImage from a project-owned GitHub repository; while the host is not whitelisted, the source is from a plausible project maintainer and the AppImage is verified via checksum, with no obfuscated or malicious behavior evident.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 90%): Package installs a prebuilt AppImage from a project-owned GitHub repository; while the host is not whitelisted, the source is from a plausible project maintainer and the AppImage is verified via checksum, with no obfuscated or malicious behavior evident.

PKGBUILD

      1# Maintainer: Firstpick <firstpick1992@proton.me>
    
      2#
    
      3# Generated by scripts/aur_package.py from packaging/aur/PKGBUILD.in in
    
      4# https://github.com/ClawPick2026/leafsmith for one published release.
    
      5# Change the template there: edits made only on AUR are replaced.
    
      6
    
      7pkgname=leafsmith-bin
    
      8# The app's command, icon and /opt directory, its Tauri productName (AppImage
    
      9# name and resource directory) and its frozen worker.
    
      10_appname=leafsmith
    
      11_product=Leafsmith
    
      12_worker=leafsmith-worker
    
      13pkgver=0.1.0rc3
    
      14pkgrel=1
    
      15pkgdesc='Local-first PDF, document, image and media tools (prebuilt AppImage contents)'
    
      16arch=('x86_64')
    
      17url='https://github.com/ClawPick2026/leafsmith'
    
      18# Application code is MIT. The AppImage bundles libraries under their own
    
      19# licenses; their notices are linked from /usr/share/licenses/$pkgname/third-party.
    
      20# The release also publishes the exact corresponding sources of the bundled
    
      21# Linux libraries (Leafsmith-linux-corresponding-sources.zip).
    
      22license=('MIT' 'LicenseRef-Leafsmith-third-party-notices')
    
      23# The AppImage bundles GTK, WebKitGTK and the Python worker. These are the
    
      24# host libraries it leaves out (glibc, graphics, X11/Wayland, fonts) and the
    
      25# shell that runs AppRun.
    
      26depends=('bash' 'e2fsprogs' 'expat' 'fontconfig' 'freetype2' 'fribidi' 'glibc'
    
      27         'gmp' 'harfbuzz' 'hicolor-icon-theme' 'libdrm' 'libglvnd' 'libgpg-error'
    
      28         'libx11' 'libxcb' 'mesa' 'ttf-font' 'wayland')
    
      29provides=("$_appname=$pkgver")
    
      30conflicts=("$_appname")
    
      31# Install the bundle as released: stripping would corrupt the frozen worker, and
    
      32# makepkg's defaults would also drop bundled static and libtool archives.
    
      33options=('!strip' '!debug' 'staticlibs' 'libtool' '!purge')
    
      34_tag='v0.1.0-rc.3'
    
      35_appimage='Leafsmith_0.1.0_amd64.AppImage'
    
      36source=("$_appname-$pkgver.AppImage::$url/releases/download/$_tag/$_appimage"
    
      37        "$_appname.sh"
    
      38        "$_appname.desktop")
    
      39sha256sums=('726ff00e552c8e2666c92d82b155d5b4b91211ff8aa1bc841742cbb1a67c6e97'
    
      40            'bcb4eae65901538bf38db572040fdbcc9bccae349a8768fe91dfd1dfba67fa8c'
    
      41            'fa081ec8194a960c7c779407f0de6db700a399ca6e7813db2a4694939cd67b7a')
    
      42
    
      43prepare() {
    
      44  # The AppImage runtime unpacks its squashfs without FUSE; the app does not run.
    
      45  rm -rf squashfs-root
    
      46  chmod u+x "$_appname-$pkgver.AppImage"
    
      47  "./$_appname-$pkgver.AppImage" --appimage-extract > /dev/null
    
      48}
    
      49
    
      50package() {
    
      51  local app=squashfs-root
    
      52  local notices="$app/usr/lib/$_product/worker/third-party-licenses"
    
      53  local file
    
      54  for file in "$app/AppRun" "$app/usr/bin/$_appname" "$app/usr/lib/$_product/worker/$_worker"; do
    
      55    [[ -x "$file" ]] || { echo "Unexpected AppImage layout: missing $file" >&2; return 1; }
    
      56  done
    
      57
    
      58  install -d "$pkgdir/opt"
    
      59  cp -a --no-preserve=ownership "$app" "$pkgdir/opt/$_appname"
    
      60  # The squashfs stores some copied notices and GSettings schemas world-writable.
    
      61  chmod -R u+rwX,go+rX,go-w "$pkgdir/opt/$_appname"
    
      62
    
      63  install -Dm755 "$_appname.sh" "$pkgdir/usr/bin/$_appname"
    
      64  install -Dm644 "$_appname.desktop" "$pkgdir/usr/share/applications/$_appname.desktop"
    
      65  install -Dm644 "$app/usr/share/icons/hicolor/512x512/apps/$_appname.png" \
    
      66    "$pkgdir/usr/share/icons/hicolor/512x512/apps/$_appname.png"
    
      67  install -Dm644 "$notices/application-MIT.txt" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      68  ln -s "/opt/$_appname/usr/lib/$_product/worker/third-party-licenses" \
    
      69    "$pkgdir/usr/share/licenses/$pkgname/third-party"
    
      70}
    
      71

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-19 00:03:55	Low	2
2026-10-18 23:23:07	Low	2