lumina-code-bin
LOW
maintainer Iewnfod
0 votes
scanned 2026-09-26 09:14:41.464653
Why flagged
The package downloads prebuilt .deb files from GitHub Releases over HTTPS, which are verified via hardcoded SHA-256 checksums; while the binaries are not built from source, the use of signed releases from the project's official repository and proper checksum validation limits risk to low.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads prebuilt .deb files from GitHub Releases over HTTPS, which are verified via hardcoded SHA-256 checksums; while the binaries are not built from source, the use of signed releases from the project's official repository and proper checksum validation limits risk to low.
PKGBUILD
1
# Composed Lumina Code AUR PKGBUILD.
2
#
3
# This file is a TEMPLATE rendered by .github/workflows/aur.yml before being
4
# pushed to AUR. The ${...} placeholders are substituted at release-publish
5
# time (see the render step in the workflow). Do NOT edit the rendered values
6
# by hand on AUR — regenerate via the workflow instead.
7
#
8
# The Maintainer line below is injected verbatim into the rendered PKGBUILD.
9
# Edit it once here; it propagates to AUR on every publish. namcap/aurweb
10
# both expect this tag on every AUR package.
11
# Maintainer: Iewnfod <iewnfoddd@outlook.com>
12
#
13
# Local sanity check (does NOT download the .deb — checksums are placeholders
14
# until rendered):
15
# namcap .aur/PKGBUILD
16
#
17
# This is a -bin package: it downloads the upstream .deb produced by the
18
# Release workflow and repackages it for pacman. Both supported architectures
19
# are published from a single PKGBUILD via per-arch source/checksum arrays.
20
#
21
# NOTE on the bundled OpenCode server: the .deb carries a self-contained
22
# sidecar binary (usr/lib/Lumina.Code/opencode-<triple> inside the payload),
23
# which adds NO extra system dependencies — it is a statically linked
24
# single-file executable.
25
26
pkgname=lumina-code-bin
27
pkgver=0.1.1
28
pkgrel=1
29
pkgdesc="A Tauri + React desktop GUI for OpenCode, bundling its own pinned server binary"
30
arch=('x86_64' 'aarch64')
31
url="https://github.com/iewnfod/lumina-code"
32
license=('MPL-2.0')
33
34
# Translated from the .deb's own Depends (libwebkit2gtk-4.1-0, libgtk-3-0, …)
35
# to their Arch equivalents. libayatana-appindicator covers the AppIndicator
36
# binding Tauri's GTK shell uses.
37
depends=(
38
'webkit2gtk-4.1'
39
'gtk3'
40
'libayatana-appindicator'
41
'hicolor-icon-theme'
42
)
43
provides=("${pkgname%-bin}=${pkgver}")
44
conflicts=("${pkgname%-bin}")
45
optdepends=(
46
'xdg-utils: open files/URLs from the app'
47
)
48
49
# Asset names differ per ecosystem — .deb uses dpkg arches (amd64/arm64):
50
# x86_64 -> Lumina.Code_<ver>_amd64.deb
51
# aarch64 -> Lumina.Code_<ver>_arm64.deb
52
source_x86_64=("${pkgname}-${pkgver}-amd64.deb::${url}/releases/download/v${pkgver}/Lumina.Code_${pkgver}_amd64.deb")
53
source_aarch64=("${pkgname}-${pkgver}-arm64.deb::${url}/releases/download/v${pkgver}/Lumina.Code_${pkgver}_arm64.deb")
54
sha256sums_x86_64=('28458f3141ee372870aa7702f7f955bce6c153aead27b9f8d497439c271185e9')
55
sha256sums_aarch64=('85424e4efc60de9912d21bceff157dd91f89c835f5663d7096119b2344bd4241')
56
57
# No arch-independent sources — empty arrays keep makepkg's parser happy.
58
source=()
59
sha256sums=()
60
61
# A .deb is an ar(1) archive, not a tarball — stop makepkg from auto-extracting.
62
noextract=("${pkgname}-${pkgver}-"*.deb)
63
64
package() {
65
# The .deb is an `ar` archive containing data.tar.<comp>; extract that
66
# payload into a scratch dir, then relocate its usr/ tree into $pkgdir.
67
# bsdtar (libarchive) reads .deb natively, so no extra depends on `ar`.
68
cd "${srcdir}"
69
70
local scratch="${srcdir}/_unpacked"
71
rm -rf "${scratch}"
72
mkdir "${scratch}"
73
74
# The downloaded .deb lands in $srcdir under the filename on the LEFT of
75
# the `::` in each source_* entry. makepkg exposes the entry *as written*
76
# (i.e. "name::url"), so strip the "::url" suffix to get the local filename.
77
# ${...%%::*} strips the longest match of "::" + everything after it.
78
local entry="${source_x86_64[0]:-${source_aarch64[0]}}"
79
local deb="${entry%%::*}"
80
81
# A .deb is an `ar` archive whose `data.tar.*` member holds the actual
82
# filesystem tree. We stream that member out of the .deb and into the
83
# scratch dir in one pipe. The `data.tar.*` is quoted so the shell does
84
# NOT glob-expand it locally — bsdtar matches it against members inside
85
# the .deb (verified against the lumina-terminal v0.1.5 release payload).
86
#
87
# The payload already lays out usr/{bin,lib,share/applications,share/icons/...}
88
# exactly as pacman expects it (the sidecar rides under usr/lib/Lumina.Code/),
89
# so we have nothing to reassemble here.
90
bsdtar -xOf "${deb}" 'data.tar.*' | bsdtar -xf - -C "${scratch}"
91
92
# Relocate the extracted tree into $pkgdir verbatim, preserving mode,
93
# symlinks and mtimes. -a copies recursively with attributes retained.
94
cp -a "${scratch}/." "${pkgdir}/"
95
}
96
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-26 09:14:41 | Low | 2 |