linksy

LOW

maintainer guglovich 0 votes scanned 2026-10-24 13:42:06.374786

View on AUR

Why flagged

Package builds from its own GitHub source tarball with a proper checksum; the flagged 'privileged install' is just installing udev rules and a systemd user service via standard install -Dm644 into pkgdir, which is normal AUR packaging. The _prepare_rust helper only runs 'rustup toolchain install stable --no-self-update' if needed, which is benign. Low votes/recent upload is a minor concern but no actual malicious behaviour is present.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Package builds from its own GitHub source tarball with a proper checksum; the flagged 'privileged install' is just installing udev rules and a systemd user service via standard install -Dm644 into pkgdir, which is normal AUR packaging. The _prepare_rust helper only runs 'rustup toolchain install stable --no-self-update' if needed, which is benign. Low votes/recent upload is a minor concern but no actual malicious behaviour is present.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:51 rustup toolchain install stable --profile minimal --no-self-update

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: guglovich <guglovich164@gmail.com>
    
      2# Contributor: Dokja620 <revanamike620@gmail.com>
    
      3# Created with assistance from GLM 5.3 Flash.
    
      4# Based on upstream packaging/aur/PKGBUILD.
    
      5# One build, three packages, as Transmission splits its apps: linksy-common (the service and
    
      6# tools), linksy (the GTK app) and linksy-qt (the Qt app, for KDE Plasma).
    
      7pkgbase=linksy
    
      8pkgname=(linksy-common linksy linksy-qt)
    
      9pkgver=0.9.6
    
      10pkgrel=1
    
      11pkgdesc='Your phone and your Linux computer, working as one: files, clipboard, screens, webcam'
    
      12arch=('x86_64')
    
      13url='https://github.com/LinkSy-mg/linksy-desktop'
    
      14license=('AGPL-3.0-or-later')
    
      15# ring 0.17 не линкуется с -flto из makepkg CFLAGS (undefined symbols ring_core_*):
    
      16# LTO в Rust задаёт сам профиль (lto = "thin"), C-часть ring с LTO gcc ломается.
    
      17options=(!debug !lto)
    
      18makedepends=('cargo' 'lld' 'gtk4' 'libadwaita' 'gstreamer' 'gst-plugins-base' 'qt6-base' 'qt6-declarative')
    
      19source=("$pkgbase-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
    
      20sha256sums=('646544f0bc796716bfb70950350e80032c1e6ec0235528ae107d53aaf558921d')
    
      21
    
      22prepare() {
    
      23  cd linksy-desktop-$pkgver
    
      24  _prepare_rust
    
      25  cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      26}
    
      27
    
      28build() {
    
      29  cd linksy-desktop-$pkgver
    
      30  _prepare_rust
    
      31  export CARGO_TARGET_DIR=target QMAKE=/usr/bin/qmake6
    
      32  cargo build --frozen --release -p linksyd -p linksy -p linksy-app -p linksy-screen -p linksy-qt
    
      33}
    
      34
    
      35check() {
    
      36  cd linksy-desktop-$pkgver
    
      37  _prepare_rust
    
      38  export CARGO_TARGET_DIR=target
    
      39  cargo test --frozen --release -p linksy-core --lib
    
      40}
    
      41
    
      42# Rust: workspace uses edition 2024, needs rustc >= 1.85.
    
      43#  - users of the plain `rust`/`cargo` packages have no rustup at all; there
    
      44#    RUSTUP_TOOLCHAIN is not read by anything and system rustc is current.
    
      45#  - rustup users may have an old default pinned (e.g. 1.78, which fails), so for
    
      46#    them we pin stable and install it when missing.
    
      47_prepare_rust() {
    
      48  if command -v rustup >/dev/null 2>&1; then
    
      49    if ! rustup run stable rustc --version >/dev/null 2>&1; then
    
      50      echo '==> rustup: installing the stable toolchain (edition 2024 needs rustc >= 1.85)'
    
      51      rustup toolchain install stable --profile minimal --no-self-update
    
      52    fi
    
      53    export RUSTUP_TOOLCHAIN=stable
    
      54  fi
    
      55}
    
      56
    
      57package_linksy-common() {
    
      58  pkgdesc='Your devices, connected: the service and tools both Linksy apps share'
    
      59  depends=('dbus' 'gcc-libs' 'glibc' 'gstreamer' 'gst-plugins-base' 'gst-plugins-good' 'gst-plugin-pipewire' 'xdg-desktop-portal')
    
      60  # Never without a window: pacman asks which, linksy (GTK) or linksy-qt (KDE Plasma)
    
      61  depends+=('linksy-window')
    
      62  optdepends=('gst-libav: H.264 decoding, to see screens'
    
      63              'gst-plugins-bad: H.264 encoding on the graphics card (VA-API)'
    
      64              'gst-plugins-ugly: H.264 encoding with x264'
    
      65              'wl-clipboard: shared clipboard while the window is not focused'
    
      66              'v4l2loopback-dkms: the phone as a webcam in every app'
    
      67              'v4l2loopback-utils: the phone as a webcam in every app')
    
      68  # Before 0.8.4, one linksy package held everything
    
      69  conflicts=('linksy<0.8.4')
    
      70  cd linksy-desktop-$pkgver
    
      71  for b in linksyd linksy linksy-screen; do
    
      72    install -Dm755 "target/release/$b" "$pkgdir/usr/bin/$b"
    
      73  done
    
      74  install -Dm755 data/linksy-open "$pkgdir/usr/bin/linksy-open"
    
      75  for s in linksy-camera-setup linksy-usb-setup linksy-system-setup; do
    
      76    install -Dm755 "data/$s" "$pkgdir/usr/lib/linksy/$s"
    
      77  done
    
      78  sed 's|@BINDIR@|/usr/bin|' data/linksyd.service | install -Dm644 /dev/stdin "$pkgdir/usr/lib/systemd/user/linksyd.service"
    
      79  install -Dm644 data/linksyd-autostart.desktop "$pkgdir/etc/xdg/autostart/linksyd.desktop"
    
      80  install -Dm644 data/70-linksy-usb.rules "$pkgdir/usr/lib/udev/rules.d/70-linksy-usb.rules"
    
      81  install -Dm644 data/linksy.firewalld.xml "$pkgdir/usr/lib/firewalld/services/linksy.xml"
    
      82  sed 's|^Exec=linksy-app|Exec=linksy-open|' data/mg.diary.linksy.Linksy.desktop | install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/mg.diary.linksy.Linksy.desktop"
    
      83  install -Dm644 data/mg.diary.linksy.Linksy.metainfo.xml "$pkgdir/usr/share/metainfo/mg.diary.linksy.Linksy.metainfo.xml"
    
      84  install -Dm644 data/icons/mg.diary.linksy.Linksy.svg "$pkgdir/usr/share/icons/hicolor/scalable/apps/mg.diary.linksy.Linksy.svg"
    
      85  install -Dm644 data/icons/mg.diary.linksy.Linksy-symbolic.svg "$pkgdir/usr/share/icons/hicolor/symbolic/apps/mg.diary.linksy.Linksy-symbolic.svg"
    
      86  install -Dm644 -t "$pkgdir/usr/share/licenses/$pkgname" LICENSE THIRD-PARTY-NOTICES
    
      87}
    
      88
    
      89package_linksy() {
    
      90  pkgdesc='Your phone and your Linux computer, working as one (GTK app, for GNOME and most desktops)'
    
      91  depends=("linksy-common=$pkgver" 'gtk4' 'libadwaita' 'gst-plugin-gtk4')
    
      92  provides=('linksy-window')
    
      93  cd linksy-desktop-$pkgver
    
      94  install -Dm755 target/release/linksy-app "$pkgdir/usr/bin/linksy-app"
    
      95}
    
      96
    
      97package_linksy-qt() {
    
      98  pkgdesc='Your phone and your Linux computer, working as one (Qt app, for KDE Plasma)'
    
      99  depends=("linksy-common=$pkgver" 'gstreamer' 'qt6-base' 'qt6-declarative' 'kirigami' 'kirigami-addons' 'qqc2-desktop-style' 'gst-plugin-qml6')
    
      100  provides=('linksy-window')
    
      101  cd linksy-desktop-$pkgver
    
      102  install -Dm755 target/release/linksy-qt "$pkgdir/usr/bin/linksy-qt"
    
      103}
    
      104

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-24 13:42:06	Low	3
2026-10-24 13:40:12	Medium	2