lumoria-bin

MEDIUM

maintainer rysas 0 votes scanned 2026-09-11 17:24:54.958678

View on AUR

Why flagged

Installs a prebuilt x86_64 binary tarball from 'builds.lumoria.dev', a non-GitHub build server unrelated to the project's official GitHub repo (github.com/Windower/Lumoria); while the checksum is present, the artifact comes from a separate infrastructure that could be silently swapped, making it an unverifiable prebuilt executable from a potentially swappable host.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 source=("lumoria-$pkgver-x86_64.tar.zst::https://builds.lumoria.dev/arch/lumoria-$pkgver-x86_64.tar.zst")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs a prebuilt x86_64 binary tarball from 'builds.lumoria.dev', a non-GitHub build server unrelated to the project's official GitHub repo (github.com/Windower/Lumoria); while the checksum is present, the artifact comes from a separate infrastructure that could be silently swapped, making it an unverifiable prebuilt executable from a potentially swappable host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Damian Miller <rysas@mail.naimad.dev>
    
      2pkgname=lumoria-bin
    
      3pkgver=0.2.0
    
      4pkgrel=1
    
      5pkgdesc="A Linux installer and launcher for Final Fantasy XI"
    
      6arch=('x86_64')
    
      7url="https://github.com/Windower/Lumoria"
    
      8license=('GPL-3.0-or-later')
    
      9provides=('lumoria')
    
      10conflicts=('lumoria')
    
      11depends=(
    
      12  'gtk4'
    
      13  'json-glib'
    
      14  'libadwaita'
    
      15  'libarchive'
    
      16  'libgee'
    
      17  'libgit2-glib'
    
      18  'libmspack'
    
      19  'libsoup3'
    
      20  'libmanette'
    
      21  'libportal'
    
      22  'libportal-gtk4'
    
      23  'vte4'
    
      24  'libxml2'
    
      25)
    
      26source=("lumoria-$pkgver-x86_64.tar.zst::https://builds.lumoria.dev/arch/lumoria-$pkgver-x86_64.tar.zst")
    
      27sha256sums=('cb1beafde5201923a1ef881204fd05b6e53edf8752c95edfcf51feae9216fa89')
    
      28
    
      29package() {
    
      30  cp -a "$srcdir/usr" "$pkgdir/"
    
      31}
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-11 17:24:54	Medium	3
2026-09-11 17:22:59	Medium	2