luadot-bin

MEDIUM

maintainer ItzTas 0 votes scanned 2026-09-04 03:56:15.771161

View on AUR

Why flagged

The package downloads prebuilt binaries from a non-whitelisted, personal GitLab instance with no verifiable upstream source, creating a supply-chain risk if the host were compromised or malicious.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package downloads prebuilt binaries from a non-whitelisted, personal GitLab instance with no verifiable upstream source, creating a supply-chain risk if the host were compromised or malicious.

PKGBUILD

      1# Maintainer: ItzTas <ts.aur@imts.aleeas.com>
    
      2
    
      3pkgname=luadot-bin
    
      4_pkgname=luadot
    
      5pkgver=0.3.0
    
      6pkgrel=1
    
      7pkgdesc='A dotfiles manager configured in Lua (prebuilt binary)'
    
      8arch=('x86_64' 'aarch64')
    
      9url='https://github.com/ItzTas/luadot'
    
      10license=('MIT')
    
      11depends=('gcc-libs' 'glibc')
    
      12provides=("$_pkgname=$pkgver")
    
      13conflicts=("$_pkgname")
    
      14options=('!strip' '!debug')
    
      15_registry='https://gitlab.digitalventura.com.br/api/v4/projects/luadot%2Fluadot/packages/generic/luadot'
    
      16_version=0.3.0
    
      17source_x86_64=("$_registry/$_version/$_pkgname-$pkgver-x86_64.tar.gz")
    
      18source_aarch64=("$_registry/$_version/$_pkgname-$pkgver-aarch64.tar.gz")
    
      19sha256sums_x86_64=('faf4365481ec7eef6c7694499c33da57bf53cb06f9b2a08403b3ed240a89c7a0')
    
      20sha256sums_aarch64=('83bfb438387b391613a005ed2599f665631ff4566b9e27404254d2cbf1e87b26')
    
      21
    
      22package() {
    
      23	cd "$_pkgname-$pkgver-$CARCH"
    
      24	install -Dm0755 "$_pkgname" "$pkgdir/usr/bin/$_pkgname"
    
      25	install -Dm0644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      26	install -Dm0644 LICENSE.lpeg "$pkgdir/usr/share/licenses/$pkgname/LICENSE.lpeg"
    
      27
    
      28	install -Dm0644 "completions/$_pkgname.bash" \
    
      29		"$pkgdir/usr/share/bash-completion/completions/$_pkgname"
    
      30	install -Dm0644 "completions/_$_pkgname" \
    
      31		"$pkgdir/usr/share/zsh/site-functions/_$_pkgname"
    
      32	install -Dm0644 "completions/$_pkgname.fish" \
    
      33		"$pkgdir/usr/share/fish/vendor_completions.d/$_pkgname.fish"
    
      34
    
      35	install -Dm0644 "$_pkgname.1" "$pkgdir/usr/share/man/man1/$_pkgname.1"
    
      36}
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-04 03:56:15	Medium	2