lume-bin

maintainer hugomyb · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt binary from a .deb archive hosted on GitHub, which is not the project's official release mechanism and could be tampered with if the maintainer's account is compromised, though the source is otherwise legitimate and checksums are provided for the binary.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a .deb archive hosted on GitHub, which is not the project's official release mechanism and could be tampered with if the maintainer's account is compromised, though the source is otherwise legitimate and checksums are provided for the binary.

PKGBUILD

      1# Maintainer: Hugo Mayonobe <hugomyb@users.noreply.github.com>
    
      2pkgname=lume-bin
    
      3pkgver=1.0.11
    
      4pkgrel=1
    
      5pkgdesc="Fast, lightweight, open-source terminal — a private, local alternative to Warp"
    
      6arch=('x86_64')
    
      7url="https://github.com/hugomyb/Lume"
    
      8license=('MIT')
    
      9depends=('webkit2gtk-4.1' 'gtk3')
    
      10optdepends=('cloudflared: remote control over the internet (cross-network)')
    
      11provides=('lume')
    
      12conflicts=('lume')
    
      13options=('!strip')
    
      14source=("Lume_${pkgver}_amd64.deb::https://github.com/hugomyb/Lume/releases/download/v${pkgver}/Lume_${pkgver}_amd64.deb"
    
      15        "LICENSE::https://raw.githubusercontent.com/hugomyb/Lume/v${pkgver}/LICENSE")
    
      16sha256sums=('0d1699d7b91cd87b3dbda08bef717de45ec8c87ac0a1f8ee3262c9813d2de6c6'
    
      17            'SKIP')
    
      18
    
      19package() {
    
      20  # A .deb is an `ar` archive holding data.tar.* with the installed tree.
    
      21  bsdtar -xf "Lume_${pkgver}_amd64.deb" -C "$srcdir"
    
      22  bsdtar -xf "$srcdir"/data.tar.* -C "$pkgdir"
    
      23  install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      24}
    
      25

Changes since previous scan

--- PKGBUILD @ 2026-07-28 00:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 # Maintainer: Hugo Mayonobe <hugomyb@users.noreply.github.com>
 pkgname=lume-bin
-pkgver=1.0.10
+pkgver=1.0.11
 pkgrel=1
 pkgdesc="Fast, lightweight, open-source terminal — a private, local alternative to Warp"
 arch=('x86_64')
@@ -13,7 +13,7 @@
 options=('!strip')
 source=("Lume_${pkgver}_amd64.deb::https://github.com/hugomyb/Lume/releases/download/v${pkgver}/Lume_${pkgver}_amd64.deb"
         "LICENSE::https://raw.githubusercontent.com/hugomyb/Lume/v${pkgver}/LICENSE")
-sha256sums=('60a0e8d96f728b473bbdcee62898fa60a956313d9faba9536bbaac144017d5a6'
+sha256sums=('0d1699d7b91cd87b3dbda08bef717de45ec8c87ac0a1f8ee3262c9813d2de6c6'
             'SKIP')
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 09:37:42	MEDIUM	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 15:27:57	LOW	2
2026-07-24 09:27:42	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 11:14:00	MEDIUM	2