lumina-terminal-bin
maintainer Iewnfod
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads prebuilt .deb binaries from the project's official GitHub releases, which is a common but less verifiable practice; however, it does not execute unreviewed remote code or introduce malicious payloads, and the source is from the legitimate project maintainer.
Triggered rules
LOW
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
LOW
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads prebuilt .deb binaries from the project's official GitHub releases, which is a common but less verifiable practice; however, it does not execute unreviewed remote code or introduce malicious payloads, and the source is from the legitimate project maintainer.
PKGBUILD
1
# Composed Lumina Terminal AUR PKGBUILD.
2
#
3
# This file is a TEMPLATE rendered by .github/workflows/aur.yml before being
4
# pushed to AUR. The ${...} placeholders are substituted at release-publish
5
# time (see the render step in the workflow). Do NOT edit the rendered values
6
# by hand on AUR — regenerate via the workflow instead.
7
#
8
# The Maintainer line below is injected verbatim into the rendered PKGBUILD.
9
# Edit it once here; it propagates to AUR on every publish. namcap/aurweb
10
# both expect this tag on every AUR package.
11
# Maintainer: Iewnfod <iewnfoddd@outlook.com>
12
#
13
# Local sanity check (does NOT download the .deb — checksums are placeholders
14
# until rendered):
15
# namcap .aur/PKGBUILD
16
#
17
# This is a -bin package: it downloads the upstream .deb produced by the
18
# Release workflow and repackages it for pacman, mirroring what install.sh
19
# does for Arch users on the fly. Both supported architectures are published
20
# from a single PKGBUILD via per-arch source/checksum arrays.
21
22
pkgname=lumina-terminal-bin
23
pkgver=0.1.5
24
pkgrel=1
25
pkgdesc="A modern, cross-platform terminal emulator built with Tauri, React, and Xterm.js"
26
arch=('x86_64' 'aarch64')
27
url="https://github.com/iewnfod/lumina-terminal"
28
license=('MPL-2.0')
29
30
# Translated from the .deb's own Depends (libwebkit2gtk-4.1-0, libgtk-3-0, …)
31
# to their Arch equivalents. libayatana-appindicator covers the AppIndicator
32
# binding Tauri's GTK shell uses.
33
depends=(
34
'webkit2gtk-4.1'
35
'gtk3'
36
'libayatana-appindicator'
37
'hicolor-icon-theme'
38
)
39
provides=("${pkgname%-bin}=${pkgver}")
40
conflicts=("${pkgname%-bin}")
41
optdepends=(
42
'xdg-utils: open files/URLs from the terminal'
43
)
44
45
# Asset names differ per ecosystem — .deb uses dpkg arches (amd64/arm64):
46
# x86_64 -> Lumina.Terminal_<ver>_amd64.deb
47
# aarch64 -> Lumina.Terminal_<ver>_arm64.deb
48
source_x86_64=("${pkgname}-${pkgver}-amd64.deb::${url}/releases/download/v${pkgver}/Lumina.Terminal_${pkgver}_amd64.deb")
49
source_aarch64=("${pkgname}-${pkgver}-arm64.deb::${url}/releases/download/v${pkgver}/Lumina.Terminal_${pkgver}_arm64.deb")
50
sha256sums_x86_64=('0046dc0952f2f8f8c8a2568f8a706ff7f6c5bbfdd4241817227085dc073f647c')
51
sha256sums_aarch64=('5daeb506c5f10c1c5af00a4a8b519106ff148decd813153ddac9b594ab2d9898')
52
53
# No arch-independent sources — empty arrays keep makepkg's parser happy.
54
source=()
55
sha256sums=()
56
57
# A .deb is an ar(1) archive, not a tarball — stop makepkg from auto-extracting.
58
noextract=("${pkgname}-${pkgver}-"*.deb)
59
60
package() {
61
# The .deb is an `ar` archive containing data.tar.<comp>; extract that
62
# payload into a scratch dir, then relocate its usr/ tree into $pkgdir.
63
# bsdtar (libarchive) reads .deb natively, so no extra depends on `ar`.
64
cd "${srcdir}"
65
66
local scratch="${srcdir}/_unpacked"
67
rm -rf "${scratch}"
68
mkdir "${scratch}"
69
70
# The downloaded .deb lands in $srcdir under the filename on the LEFT of
71
# the `::` in each source_* entry. makepkg exposes the entry *as written*
72
# (i.e. "name::url"), so strip the "::url" suffix to get the local filename.
73
# ${...%%::*} strips the longest match of "::" + everything after it.
74
local entry="${source_x86_64[0]:-${source_aarch64[0]}}"
75
local deb="${entry%%::*}"
76
77
# A .deb is an `ar` archive whose `data.tar.*` member holds the actual
78
# filesystem tree. We stream that member out of the .deb and into the
79
# scratch dir in one pipe. The `data.tar.*` is quoted so the shell does
80
# NOT glob-expand it locally — bsdtar matches it against members inside
81
# the .deb (verified against the v0.1.5 release payload).
82
#
83
# The payload already lays out usr/{bin,share/applications,share/icons/...}
84
# exactly as pacman expects it, so we have nothing to reassemble here.
85
bsdtar -xOf "${deb}" 'data.tar.*' | bsdtar -xf - -C "${scratch}"
86
87
# Relocate the extracted tree into $pkgdir verbatim, preserving mode,
88
# symlinks and mtimes. -a copies recursively with attributes retained.
89
cp -a "${scratch}/." "${pkgdir}/"
90
}
91
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 15:14:11 | LOW | 2 |
| 2026-07-20 05:12:56 | LOW | 2 |