lumina-terminal-bin

maintainer Iewnfod · 0 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The package downloads prebuilt .deb binaries from the project's official GitHub releases, which is a common but less verifiable practice; however, it does not execute unreviewed remote code or introduce malicious payloads, and the source is from the legitimate project maintainer.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads prebuilt .deb binaries from the project's official GitHub releases, which is a common but less verifiable practice; however, it does not execute unreviewed remote code or introduce malicious payloads, and the source is from the legitimate project maintainer.

PKGBUILD

1# Composed Lumina Terminal AUR PKGBUILD.
2#
3# This file is a TEMPLATE rendered by .github/workflows/aur.yml before being
4# pushed to AUR. The ${...} placeholders are substituted at release-publish
5# time (see the render step in the workflow). Do NOT edit the rendered values
6# by hand on AUR — regenerate via the workflow instead.
7#
8# The Maintainer line below is injected verbatim into the rendered PKGBUILD.
9# Edit it once here; it propagates to AUR on every publish. namcap/aurweb
10# both expect this tag on every AUR package.
11# Maintainer: Iewnfod <iewnfoddd@outlook.com>
12#
13# Local sanity check (does NOT download the .deb — checksums are placeholders
14# until rendered):
15# namcap .aur/PKGBUILD
16#
17# This is a -bin package: it downloads the upstream .deb produced by the
18# Release workflow and repackages it for pacman, mirroring what install.sh
19# does for Arch users on the fly. Both supported architectures are published
20# from a single PKGBUILD via per-arch source/checksum arrays.
21
22pkgname=lumina-terminal-bin
23pkgver=0.1.5
24pkgrel=1
25pkgdesc="A modern, cross-platform terminal emulator built with Tauri, React, and Xterm.js"
26arch=('x86_64' 'aarch64')
27url="https://github.com/iewnfod/lumina-terminal"
28license=('MPL-2.0')
29
30# Translated from the .deb's own Depends (libwebkit2gtk-4.1-0, libgtk-3-0, …)
31# to their Arch equivalents. libayatana-appindicator covers the AppIndicator
32# binding Tauri's GTK shell uses.
33depends=(
34 'webkit2gtk-4.1'
35 'gtk3'
36 'libayatana-appindicator'
37 'hicolor-icon-theme'
38)
39provides=("${pkgname%-bin}=${pkgver}")
40conflicts=("${pkgname%-bin}")
41optdepends=(
42 'xdg-utils: open files/URLs from the terminal'
43)
44
45# Asset names differ per ecosystem — .deb uses dpkg arches (amd64/arm64):
46# x86_64 -> Lumina.Terminal_<ver>_amd64.deb
47# aarch64 -> Lumina.Terminal_<ver>_arm64.deb
48source_x86_64=("${pkgname}-${pkgver}-amd64.deb::${url}/releases/download/v${pkgver}/Lumina.Terminal_${pkgver}_amd64.deb")
49source_aarch64=("${pkgname}-${pkgver}-arm64.deb::${url}/releases/download/v${pkgver}/Lumina.Terminal_${pkgver}_arm64.deb")
50sha256sums_x86_64=('0046dc0952f2f8f8c8a2568f8a706ff7f6c5bbfdd4241817227085dc073f647c')
51sha256sums_aarch64=('5daeb506c5f10c1c5af00a4a8b519106ff148decd813153ddac9b594ab2d9898')
52
53# No arch-independent sources — empty arrays keep makepkg's parser happy.
54source=()
55sha256sums=()
56
57# A .deb is an ar(1) archive, not a tarball — stop makepkg from auto-extracting.
58noextract=("${pkgname}-${pkgver}-"*.deb)
59
60package() {
61 # The .deb is an `ar` archive containing data.tar.<comp>; extract that
62 # payload into a scratch dir, then relocate its usr/ tree into $pkgdir.
63 # bsdtar (libarchive) reads .deb natively, so no extra depends on `ar`.
64 cd "${srcdir}"
65
66 local scratch="${srcdir}/_unpacked"
67 rm -rf "${scratch}"
68 mkdir "${scratch}"
69
70 # The downloaded .deb lands in $srcdir under the filename on the LEFT of
71 # the `::` in each source_* entry. makepkg exposes the entry *as written*
72 # (i.e. "name::url"), so strip the "::url" suffix to get the local filename.
73 # ${...%%::*} strips the longest match of "::" + everything after it.
74 local entry="${source_x86_64[0]:-${source_aarch64[0]}}"
75 local deb="${entry%%::*}"
76
77 # A .deb is an `ar` archive whose `data.tar.*` member holds the actual
78 # filesystem tree. We stream that member out of the .deb and into the
79 # scratch dir in one pipe. The `data.tar.*` is quoted so the shell does
80 # NOT glob-expand it locally — bsdtar matches it against members inside
81 # the .deb (verified against the v0.1.5 release payload).
82 #
83 # The payload already lays out usr/{bin,share/applications,share/icons/...}
84 # exactly as pacman expects it, so we have nothing to reassemble here.
85 bsdtar -xOf "${deb}" 'data.tar.*' | bsdtar -xf - -C "${scratch}"
86
87 # Relocate the extracted tree into $pkgdir verbatim, preserving mode,
88 # symlinks and mtimes. -a copies recursively with attributes retained.
89 cp -a "${scratch}/." "${pkgdir}/"
90}
91

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 15:14:11 LOW 2
2026-07-20 05:12:56 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion