magpie-bin

LOW

maintainer czyt 0 votes scanned 2026-09-24 01:43:24.893483

View on AUR

Why flagged

Installs prebuilt binaries from the project's own GitHub release infrastructure (github.com/yetone/magpie-releases) with explicit sha256 checksums; the only flagged non-standard host is usemagpie.ai used solely for a PNG icon (non-executed data), so there is no meaningful supply-chain risk beyond trusting the upstream project's own release artifacts.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Installs prebuilt binaries from the project's own GitHub release infrastructure (github.com/yetone/magpie-releases) with explicit sha256 checksums; the only flagged non-standard host is usemagpie.ai used solely for a PNG icon (non-executed data), so there is no meaningful supply-chain risk beyond trusting the upstream project's own release artifacts.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 "magpie-icon-${pkgver}.png::https://usemagpie.ai/img/icon-256.png"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: czyt <czytcn@gmail.com>
    
      2pkgname=magpie-bin
    
      3pkgver=0.1.4
    
      4pkgrel=1
    
      5pkgdesc="One place to pick every AI coding agent's model: Codex, Claude Code, Gemini CLI and more"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://usemagpie.ai"
    
      8license=('MIT')
    
      9depends=('glib2' 'gtk3' 'gdk-pixbuf2' 'hicolor-icon-theme' 'libsoup3' 'libx11' 'webkit2gtk-4.1')
    
      10# Upstream installs its binary as `magpie`, which is also the binary of the
    
      11# unrelated AUR package magpie (an IPv6 NDP proxy).
    
      12provides=('magpie')
    
      13conflicts=('magpie')
    
      14options=('!strip' '!debug')
    
      15
    
      16# The desktop build (magpie) needs GTK 3 + WebKitGTK 4.1; magpie-cli is the
    
      17# static terminal build of the same tool.
    
      18source=(
    
      19    "magpie-${pkgver}-LICENSE::https://raw.githubusercontent.com/yetone/magpie/v${pkgver}/LICENSE"
    
      20    "magpie-icon-${pkgver}.png::https://usemagpie.ai/img/icon-256.png"
    
      21)
    
      22source_x86_64=(
    
      23    "magpie-${pkgver}-amd64::https://github.com/yetone/magpie-releases/releases/download/v${pkgver}/magpie-linux-amd64"
    
      24    "magpie-cli-${pkgver}-amd64::https://github.com/yetone/magpie-releases/releases/download/v${pkgver}/magpie-cli-linux-amd64"
    
      25)
    
      26source_aarch64=(
    
      27    "magpie-${pkgver}-arm64::https://github.com/yetone/magpie-releases/releases/download/v${pkgver}/magpie-linux-arm64"
    
      28    "magpie-cli-${pkgver}-arm64::https://github.com/yetone/magpie-releases/releases/download/v${pkgver}/magpie-cli-linux-arm64"
    
      29)
    
      30sha256sums=('79d2c8444715d4bc453ec4f8a0aaf2051a4c1ee5ac08f5bd2e5848aef87c7572'
    
      31            '57437c6596e05a8fcfc42d4288c030aa00ed86b69fe35d464d69d7026150c704')
    
      32sha256sums_x86_64=('d9e77f51ab5d5d21fd49e6757016de93447b1818f3903483c22346aef2b6cfc7'
    
      33                   '07e08998b8ea1654268bc78da930c9838a43901c9925669088aa6bee69bcaddd')
    
      34sha256sums_aarch64=('098de2d19f4943424888c970982d3620a1093c63fe17761f434527df9d9c9da9'
    
      35                    'a0b7e52a0b497ae16a54f9ccff7248d94b4563f3aaf39dd9ba77f8ab3809997a')
    
      36
    
      37package() {
    
      38    local _suffix
    
      39    case "$CARCH" in
    
      40        x86_64)  _suffix=amd64 ;;
    
      41        aarch64) _suffix=arm64 ;;
    
      42    esac
    
      43
    
      44    install -Dm755 "${srcdir}/magpie-${pkgver}-${_suffix}" "${pkgdir}/usr/bin/magpie"
    
      45    install -Dm755 "${srcdir}/magpie-cli-${pkgver}-${_suffix}" "${pkgdir}/usr/bin/magpie-cli"
    
      46
    
      47    install -Dm644 "${srcdir}/magpie-icon-${pkgver}.png" \
    
      48        "${pkgdir}/usr/share/icons/hicolor/256x256/apps/magpie.png"
    
      49    install -Dm644 "${srcdir}/magpie-${pkgver}-LICENSE" \
    
      50        "${pkgdir}/usr/share/licenses/magpie-bin/LICENSE"
    
      51
    
      52    install -dm755 "${pkgdir}/usr/share/applications"
    
      53    cat > "${pkgdir}/usr/share/applications/magpie.desktop" <<'EOF'
    
      54[Desktop Entry]
    
      55Type=Application
    
      56Name=magpie
    
      57Comment=Every agent's model. One place.
    
      58Exec=/usr/bin/magpie app
    
      59Icon=magpie
    
      60Categories=Development;Utility;
    
      61Terminal=false
    
      62EOF
    
      63}
    
      64

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-24 01:43:24	Low	3
2026-09-24 01:41:16	Medium	2