loaf-fm-bin

LOW

maintainer Dominiquini 1 votes scanned 2026-10-28 03:49:04.808433

View on AUR

Why flagged

The package downloads a prebuilt binary from a GitHub release, which is a supply-chain risk if the source is compromised, but it is from the project's official repository and the checksum is verified, limiting the impact.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt binary from a GitHub release, which is a supply-chain risk if the source is compromised, but it is from the project's official repository and the checksum is verified, limiting the impact.

PKGBUILD

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      2
    
      3_gitauthor=m-uvex
    
      4_gitname=loaf-fm
    
      5_appname=${_gitname%-fm}
    
      6pkgname=${_gitname}-bin
    
      7pkgdesc="Material 3 Expressive File Manager built with Qt6 Quick and Rust"
    
      8
    
      9pkgver=0.2.1
    
      10pkgrel=1
    
      11_gitversion=v${pkgver}
    
      12
    
      13arch=('x86_64')
    
      14
    
      15_ghurl="https://github.com/${_gitauthor}/${_gitname}"
    
      16_ghurlraw="https://raw.githubusercontent.com/${_gitauthor}/${_gitname}/${_gitversion}"
    
      17url=${_ghurl}
    
      18
    
      19license=('MIT')
    
      20
    
      21provides=("${_appname}")
    
      22conflicts=("${pkgname%-bin}")
    
      23
    
      24depends=('glibc' 'libgcc' 'libstdc++' 'qt6-base' 'qt6-declarative' 'qt6-svg' 'qt6-wayland' 'hicolor-icon-theme')
    
      25optdepends=('7zip: zip/7z/rar/iso and encrypted archives'
    
      26            'udisks2: mount, eject and unlock drives'
    
      27            'ffmpegthumbnailer: video thumbnails'
    
      28            'xdg-utils: open files with their default application'
    
      29            'libsecret: remember encrypted drive passphrases'
    
      30            'polkit: Open as Administrator')
    
      31
    
      32options=('!strip')
    
      33
    
      34# source=("README-${pkgver}.md::${_ghurlraw}/README.md"
    
      35# 		"LICENSE-${pkgver}::${_ghurlraw}/LICENSE")
    
      36source_x86_64=("${_appname}-${arch[0]}-${pkgver}.tzst::${_ghurl}/releases/download/${_gitversion}/${_appname}-${pkgver}-${pkgrel}-${arch[0]}.pkg.tar.zst")
    
      37sha256sums_x86_64=('e578c2ef4b1d70b606751a7ef9be090c8fb07685d70f6e30750796ef53f213b7')
    
      38
    
      39noextract=("${source_x86_64[@]%%::*}")
    
      40
    
      41package() {
    
      42	cd "${pkgdir}"
    
      43
    
      44	tar --exclude=".*" -xf "${srcdir}/${_appname}-${CARCH}-${pkgver}.tzst"
    
      45
    
      46	mv "${pkgdir}/usr/share/doc/${_appname}/" "${pkgdir}/usr/share/doc/${pkgname}/"
    
      47	mv "${pkgdir}/usr/share/licenses/${_appname}/" "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      48}
    
      49

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-28 03:49:04	Low	2