loomy-bin

MEDIUM

maintainer zxp19821005 0 votes scanned 2026-11-06 04:11:17.291409

View on AUR

Why flagged

The package downloads a prebuilt .deb from a GitHub repository not owned by the official project or vendor, which could be a supply-chain risk if the host is compromised or the source is swapped.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The package downloads a prebuilt .deb from a GitHub repository not owned by the official project or vendor, which could be a supply-chain risk if the host is compromised or the source is swapped.

PKGBUILD

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=loomy-bin
    
      3_pkgname=Loomy
    
      4_debname="cn.xunfei.${pkgname%-bin}.otohime"
    
      5pkgver=0.9.39
    
      6_electronversion=42
    
      7pkgrel=1
    
      8pkgdesc="Third-party Linux client for Loomy.第三方Loomy Linux 客户端.Loomy，你的AI工作搭子。不只是听指令的助手，更会主动理解你、帮助你，将你的想法实现并交付。"
    
      9arch=(
    
      10    'aarch64'
    
      11    'x86_64'
    
      12)
    
      13url="https://loomy.xunfei.cn"
    
      14_dlurl="https://github.com/kota-rina3/hokeshi"
    
      15license=('LicenseRef-loomy')
    
      16provides=("${pkgname%-bin}=${pkgver}")
    
      17conflicts=("${pkgname%-bin}")
    
      18depends=(
    
      19    "electron${_electronversion}"
    
      20    'nodejs'
    
      21)
    
      22source=(
    
      23    "LICENSE.html::${url}/docs/Safe/Loomy-user"
    
      24    "${pkgname%-bin}.js"
    
      25    "${pkgname%-bin}.sh"
    
      26)
    
      27options=('!strip')
    
      28source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.deb::${_dlurl}/releases/download/${_pkgname}${pkgver}/${_debname}_${pkgver}.0_arm64.deb")
    
      29source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.deb::${_dlurl}/releases/download/${_pkgname}${pkgver}/${_debname}_${pkgver}.0_amd64.deb")
    
      30sha256sums=('681ca4f4ed3c44337a1fe49f5fa012e83b0dea0d39908de0c82eb37e582a7feb'
    
      31            '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
    
      32            '62b13196a0e502ce4aa21ce710dfcfe83440bfaf87cb998ae4449780d4a9c9e6')
    
      33sha256sums_aarch64=('a596546aaa9a41a700d5d78d14984cda46e042cb0a00e556a1e91b517ea33ae5')
    
      34sha256sums_x86_64=('437632c79b16bad0c7126e96e7729005eae4396ab211593340539627476c098d')
    
      35_get_app_dir() {
    
      36	find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
    
      37		| while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
    
      38}
    
      39_check_electron_version() {
    
      40	local _v=$(strings "$(find "$(_get_app_dir)" -maxdepth 1 -type f \
    
      41		-executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)" \
    
      42		| grep -oP 'Electron/\K[0-9]+' | head -1)
    
      43	[[ -z "$_v" ]] && { echo -e "\033[1;33mNote: Could not check version.\033[0m"; return; }
    
      44	(( _v == _electronversion )) && c=32 || c=31
    
      45	echo -e "Electron version: \033[1;${c}m$_v$([[ $c -eq 31 ]] && echo " (expected $_electronversion)")\033[0m"
    
      46}
    
      47_install_icons() {
    
      48	local _src="${1:-${srcdir}}" _name="${pkgname%-bin}" _icon _ext _size _dest
    
      49	while IFS= read -r -d '' _icon; do
    
      50		_ext="${_icon##*.}"
    
      51		_size=$(echo "${_icon%/*}" | grep -oE '[0-9]+x[0-9]+|scalable' | head -1)
    
      52		[[ -z "${_size}" ]] && _size=$([[ "${_ext}" == svg ]] && echo scalable || od -An -tu1 -j16 -N8 "${_icon}" 2>/dev/null | awk '{printf "%dx%d",$1*16777216+$2*65536+$3*256+$4,$5*16777216+$6*65536+$7*256+$8}')
    
      53		[[ "${_size}" =~ ^[0-9]+x[0-9]+$ ]] || _size=scalable
    
      54		_dest=$([[ "${_icon}" == */share/pixmaps/* ]] && echo pixmaps || echo "icons/hicolor/${_size}/apps")
    
      55		install -Dm644 "${_icon}" "${pkgdir}/usr/share/${_dest}/${_name}.${_ext}"
    
      56	done < <(find "${_src}" \( -path '*/share/icons/*' -o -path '*/share/pixmaps/*' -o -path '*entries/icons/*' \) -type f \( -name '*.png' -o -name '*.svg' \) -print0 2>/dev/null)
    
      57}
    
      58prepare() {
    
      59    sed -i -e "
    
      60        s/@electronversion@/${_electronversion}/g
    
      61        s/@appname@/${pkgname%-bin}/g
    
      62    " "${srcdir}/${pkgname%-bin}.sh" "${srcdir}/${pkgname%-bin}.js"
    
      63    bsdtar -xf "${srcdir}/data."*
    
      64    _check_electron_version
    
      65    sed -i -e "
    
      66        s/Exec=\/opt\/apps\/${_debname}\/files\/${pkgname%-bin}/Exec=${pkgname%-bin} %U/g
    
      67        s/Icon=\/opt\/apps\/${_debname}\/files\/resources\/${_pkgname}.png/Icon=${pkgname%-bin}/g
    
      68    " "${srcdir}/opt/apps/${_debname}/entries/applications/${_pkgname}.desktop"
    
      69}
    
      70package() {
    
      71    install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      72    install -Dm644 "${srcdir}/${pkgname%-bin}.js" -t "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      73    cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-bin}/"
    
      74    install -Dm644 "${srcdir}/opt/apps/${_debname}/entries/applications/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname%-bin}.desktop"
    
      75    _install_icons
    
      76    install -Dm644 "${srcdir}/LICENSE.html" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      77}

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-06 04:11:17	Medium	2