llauncher-bin

maintainer AugustLight · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt .deb binary from a GitHub release hosted on a personal account without official verification, creating a supply-chain risk if the source were swapped.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt .deb binary from a GitHub release hosted on a personal account without official verification, creating a supply-chain risk if the source were swapped.

PKGBUILD

      1# Maintainer: AugustLigh <https://github.com/AugustLigh>
    
      2pkgname=llauncher-bin
    
      3pkgver=0.3.0
    
      4pkgrel=1
    
      5pkgdesc="Native Linux launcher for Arknights: Endfield"
    
      6arch=('x86_64')
    
      7url="https://github.com/AugustLigh/LLauncher"
    
      8license=('MIT')
    
      9depends=('webkit2gtk-4.1' 'gtk3' 'glib-networking' 'libayatana-appindicator' 'hicolor-icon-theme')
    
      10optdepends=('gamemode: CPU governor optimizations while gaming'
    
      11            'mangohud: FPS / frametime overlay'
    
      12            'gamescope: micro-compositor with FSR upscaling, FPS cap and HDR')
    
      13provides=('llauncher')
    
      14conflicts=('llauncher')
    
      15options=('!strip')
    
      16source=("${pkgname}-${pkgver}.deb::${url}/releases/download/${pkgver}/LLauncher_${pkgver}_amd64.deb")
    
      17sha256sums=('cc68e27011ad678e28dbf447ebf170dc89afa6767fa48b157b7deaa50845e7d8')
    
      18noextract=("${pkgname}-${pkgver}.deb")
    
      19
    
      20package() {
    
      21    bsdtar -xf "${srcdir}/${pkgname}-${pkgver}.deb" -C "${srcdir}" data.tar.gz
    
      22    bsdtar -xf "${srcdir}/data.tar.gz" -C "${pkgdir}"
    
      23}
    
      24

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 17:32:42	MEDIUM	2