lilbee-rocm

maintainer tobocop · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt executable from a GitHub release on a personal account with no verifiable build process, posing a supply-chain risk if the host is compromised or the source swapped.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The package downloads a prebuilt executable from a GitHub release on a personal account with no verifiable build process, posing a supply-chain risk if the host is compromised or the source swapped.

PKGBUILD

      1# Maintainer: tobocop <tobias@lilbee.sh>
    
      2pkgname=lilbee-rocm
    
      3pkgver=0.6.90b420.dev729
    
      4pkgrel=1
    
      5pkgdesc="The whole local AI stack in one executable: run and manage local AI models, and search your files, code, and crawled web pages, with cited answers (ROCm build)"
    
      6arch=('x86_64')
    
      7url="https://github.com/tobocop2/lilbee"
    
      8license=('MIT')
    
      9conflicts=('lilbee')
    
      10provides=('lilbee')
    
      11options=('!strip' '!debug')
    
      12source_x86_64=("lilbee-${pkgver}-rocm::${url}/releases/download/v${pkgver}/lilbee-linux-${CARCH}-rocm")
    
      13sha256sums_x86_64=('badcf852b212faaa0c1ed665450560a4ea660623f3f41ccac5b603a683465ed4')
    
      14source=("lilbee.service::${url}/raw/v${pkgver}/packaging/systemd/lilbee.service")
    
      15sha256sums=('8987137080f5b5353ca4a5bc82aa56c92c450c158e8558fa48fa8bff2cb1c69d')
    
      16
    
      17package() {
    
      18    install -Dm755 "${srcdir}/lilbee-${pkgver}-rocm" "${pkgdir}/usr/bin/lilbee"
    
      19    install -Dm644 "${srcdir}/lilbee.service" "${pkgdir}/usr/lib/systemd/user/lilbee.service"
    
      20}
    
      21

Changes since previous scan

--- PKGBUILD @ 2026-08-01 00:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 # Maintainer: tobocop <tobias@lilbee.sh>
 pkgname=lilbee-rocm
-pkgver=0.6.90b420.dev728
+pkgver=0.6.90b420.dev729
 pkgrel=1
 pkgdesc="The whole local AI stack in one executable: run and manage local AI models, and search your files, code, and crawled web pages, with cited answers (ROCm build)"
 arch=('x86_64')
@@ -10,7 +10,7 @@
 provides=('lilbee')
 options=('!strip' '!debug')
 source_x86_64=("lilbee-${pkgver}-rocm::${url}/releases/download/v${pkgver}/lilbee-linux-${CARCH}-rocm")
-sha256sums_x86_64=('827d49b788f65a71a8ca7b77acfbd3952e6a29898082336cd2a2d7cde76b98a5')
+sha256sums_x86_64=('badcf852b212faaa0c1ed665450560a4ea660623f3f41ccac5b603a683465ed4')
 source=("lilbee.service::${url}/raw/v${pkgver}/packaging/systemd/lilbee.service")
 sha256sums=('8987137080f5b5353ca4a5bc82aa56c92c450c158e8558fa48fa8bff2cb1c69d')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 01:19:40	MEDIUM	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 15:12:02	LOW	2