leviathan-bin

LOW

maintainer jupitergh 0 votes scanned 2026-08-24 19:24:22.399485

View on AUR

Why flagged

The package downloads a prebuilt binary from the project's official GitHub releases, which is a common and acceptable practice for AUR packages; the binary is not obfuscated or executed remotely, and the source is verifiable via checksum.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt binary from the project's official GitHub releases, which is a common and acceptable practice for AUR packages; the binary is not obfuscated or executed remotely, and the source is verifiable via checksum.

PKGBUILD

      1# Maintainer: Hugo González <ing.hugogh@gmail.com>
    
      2
    
      3pkgname=leviathan-bin
    
      4_appname=leviathan
    
      5pkgver=0.7.0
    
      6pkgrel=1
    
      7pkgdesc="Fast, privacy-first Git GUI client built with Tauri, Lit and Rust"
    
      8arch=('x86_64')
    
      9url="https://github.com/hegsie/Leviathan"
    
      10license=('MIT')
    
      11
    
      12# webkit2gtk-4.1 already pulls in gtk3, cairo, glib2, gdk-pixbuf2, libsoup3,
    
      13# zlib, gcc-libs, glibc and dbus, which the binary links directly; not repeated.
    
      14depends=(
    
      15  'webkit2gtk-4.1'
    
      16  'git'                # bisect, worktree, LFS, submodules, sparse-checkout,
    
      17                       # shallow clone, push --force-with-lease and GPG signing
    
      18                       # are delegated to system git; libgit2 only covers the basics
    
      19  'ca-certificates'    # the binary embeds no CA bundle: it probes /etc/ssl/certs
    
      20  'hicolor-icon-theme' # base index.theme for the icons shipped here
    
      21)
    
      22
    
      23optdepends=(
    
      24  'openssh: clone and authenticate over SSH, and manage keys from the app'
    
      25  'gnupg: sign and verify commits and tags'
    
      26  'xdg-utils: open files, folders and links with the default applications'
    
      27  'which: detect the configured external diff and merge tools'
    
      28  'libayatana-appindicator: system tray icon'
    
      29  'xdg-desktop-portal-gtk: follow the desktop light/dark theme'
    
      30  'pciutils: GPU detection to recommend a local AI model'
    
      31  'nvidia-utils: VRAM detection (nvidia-smi) for local AI on NVIDIA GPUs'
    
      32)
    
      33
    
      34provides=("${_appname}=${pkgver}")
    
      35conflicts=("${_appname}")
    
      36
    
      37# Ship the binary exactly as upstream publishes it, unstripped.
    
      38options=('!strip' '!debug')
    
      39
    
      40_deb="Leviathan_${pkgver}_amd64.deb"
    
      41source=("https://github.com/hegsie/Leviathan/releases/download/v${pkgver}/${_deb}"
    
      42        "LICENSE-${pkgver}::https://raw.githubusercontent.com/hegsie/Leviathan/v${pkgver}/LICENSE")
    
      43noextract=("${_deb}")
    
      44sha256sums=('2275dda674131c68f3a1b5656507ceea64ad3e6229c3a2ffee912664be230729'
    
      45            'a363ba4cc1a17c9a5c3a6206d866769447f6dd9ea996910e400262b981fb2163')
    
      46
    
      47package() {
    
      48  bsdtar -xf "${srcdir}/${_deb}" -C "${srcdir}"
    
      49  bsdtar -xf "${srcdir}"/data.tar.* -C "${pkgdir}"
    
      50
    
      51  install -Dm644 "${srcdir}/LICENSE-${pkgver}" \
    
      52    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      53}
    
      54
    
      55# The binary statically links OpenSSL 3.5.5, libgit2 1.9.4, libssh2 1.11.1,
    
      56# SQLite 3.53.2 and llama.cpp: those copies do not receive Arch security
    
      57# updates and only change when upstream ships a new release.
    
      58

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-24 19:24:22	Low	2