liscan-bin

maintainer RamazanBerk · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt Debian package from a non-whitelisted GitHub release, which is an unverifiable executable artifact; while the source is from the project's own repository, the binary nature of the download creates a supply-chain risk if the upstream build process is compromised or malicious.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt Debian package from a non-whitelisted GitHub release, which is an unverifiable executable artifact; while the source is from the project's own repository, the binary nature of the download creates a supply-chain risk if the upstream build process is compromised or malicious.

PKGBUILD

      1# Maintainer: RamazanBerk20 <ramazanberksirin@protonmail.com>
    
      2pkgname=liscan-bin
    
      3pkgver=1.0.0
    
      4pkgrel=1
    
      5pkgdesc="Clear, complete disk usage scanner for Linux (prebuilt)"
    
      6arch=('x86_64')
    
      7url="https://github.com/RamazanBerk20/LiScan"
    
      8license=('GPL-3.0-or-later')
    
      9depends=('gtk3' 'webkit2gtk-4.1' 'glib2' 'polkit')
    
      10optdepends=(
    
      11  'gvfs: scan remote locations'
    
      12  'kio: file-manager context menu integration'
    
      13)
    
      14provides=("liscan=$pkgver")
    
      15conflicts=('liscan')
    
      16_deb="LiScan_${pkgver}_amd64.deb"
    
      17source_x86_64=(
    
      18  "$_deb::$url/releases/download/v$pkgver/$_deb"
    
      19  "LICENSE-$pkgver::https://raw.githubusercontent.com/RamazanBerk20/LiScan/v$pkgver/LICENSE"
    
      20)
    
      21noextract=("$_deb")
    
      22sha256sums_x86_64=(
    
      23  '666866911503ba11d6e0874ca2bff1ff431551be93a42909909056f9e8a6385f'
    
      24  'fb981668c18a279e285fc4d83fba1e836cc84dd4daa73c9697d3cfd2d8aca6e0'
    
      25)
    
      26
    
      27package() {
    
      28  local data_archive
    
      29  mkdir -p "$srcdir/deb"
    
      30  bsdtar -xf "$srcdir/$_deb" -C "$srcdir/deb"
    
      31  data_archive=$(find "$srcdir/deb" -maxdepth 1 -name 'data.tar.*' -print -quit)
    
      32  bsdtar -xf "$data_archive" -C "$pkgdir"
    
      33  install -Dm644 "$srcdir/LICENSE-$pkgver" \
    
      34    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 17:35:03	MEDIUM	2