manis-bin

MEDIUM

maintainer bobosingle 0 votes scanned 2026-08-30 07:41:46.840772

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release without source compilation, creating a supply-chain risk if the release artifact is tampered with or unofficial.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt binary from a GitHub release without source compilation, creating a supply-chain risk if the release artifact is tampered with or unofficial.

PKGBUILD

      1# Maintainer: bobo <https://aur.archlinux.org/account/bobosingle>
    
      2
    
      3pkgname=manis-bin
    
      4pkgver=0.1.21
    
      5pkgrel=1
    
      6pkgdesc="GPUI desktop workbench for policy-based proxy routing"
    
      7arch=('x86_64')
    
      8url="https://github.com/kaigedong/Manis"
    
      9license=('Apache-2.0' 'GPL-3.0-only')
    
      10depends=(
    
      11  'alsa-lib'
    
      12  'cairo'
    
      13  'fontconfig'
    
      14  'freetype2'
    
      15  'gcc-libs'
    
      16  'gdk-pixbuf2'
    
      17  'glib2'
    
      18  'glibc'
    
      19  'gtk3'
    
      20  'hicolor-icon-theme'
    
      21  'libappindicator'
    
      22  'libx11'
    
      23  'libxcb'
    
      24  'libxkbcommon'
    
      25  'libxkbcommon-x11'
    
      26  'pango'
    
      27  'polkit'
    
      28  'vulkan-icd-loader'
    
      29  'wayland'
    
      30  'xdotool'
    
      31)
    
      32provides=("manis=${pkgver}")
    
      33conflicts=('manis')
    
      34options=('!debug' '!strip')
    
      35_upstream_pkgrel=1
    
      36source_x86_64=(
    
      37  "manis-${pkgver}-${_upstream_pkgrel}-${CARCH}.pkg.tar.zst::https://github.com/kaigedong/Manis/releases/download/build-${pkgver}/manis-${pkgver}-${_upstream_pkgrel}-${CARCH}.pkg.tar.zst"
    
      38)
    
      39sha256sums_x86_64=('ebb9383dad3f006a5f625881590138cdabc636c2a164b8c4516faf1892e8b06a')
    
      40
    
      41package() {
    
      42  cp -a "${srcdir}/usr" "${pkgdir}/"
    
      43  rm "${pkgdir}/usr/share/licenses/manis/Mihomo-GPL-3.0.txt"
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-30 07:41:46	Medium	2