marktext-deb

MEDIUM

maintainer zzy-ac 0 votes scanned 2026-09-03 07:52:31.983971

View on AUR

Why flagged

The package downloads a prebuilt .deb from GitHub releases, but uses 'pkgver=null' which results in an invalid URL and likely prevents successful verification; this creates a supply-chain risk if the source resolves unexpectedly.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package downloads a prebuilt .deb from GitHub releases, but uses 'pkgver=null' which results in an invalid URL and likely prevents successful verification; this creates a supply-chain risk if the source resolves unexpectedly.

PKGBUILD

      1# Maintainer: zzy-ac <zzy-ac@qq.com>
    
      2
    
      3pkgname=marktext-deb
    
      4_pkgname=marktext
    
      5pkgver=null
    
      6pkgrel=1
    
      7pkgdesc=" A simple and elegant open-source markdown editor that focused on speed and usability."
    
      8arch=("x86_64")
    
      9url="https://github.com/marktext/marktext"
    
      10license=(MIT)
    
      11provides=("$_pkgname")
    
      12conflicts=("$_pkgname")
    
      13depends=('gtk3'  'libsecret'  'libxkbfile'  'libxss'  'nss')
    
      14source=(
    
      15  "$url/releases/download/v$pkgver/$_pkgname-linux-$pkgver.deb")
    
      16sha256sums=('60eb7f15920f8a6b3be0d3363c9447dafa7379935b1537ffe442e562083b70a3')
    
      17
    
      18build() {
    
      19  mkdir -p "${srcdir}/dpkgdir"
    
      20  tar -xvf data.tar.xz -C "${srcdir}/dpkgdir"
    
      21}
    
      22
    
      23package() {
    
      24  cp -r "${srcdir}/dpkgdir"/* "${pkgdir}"
    
      25} 
    
      26

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-09-03 07:52
@@ -2,7 +2,7 @@
 
 pkgname=marktext-deb
 _pkgname=marktext
-pkgver=0.19.1
+pkgver=null
 pkgrel=1
 pkgdesc=" A simple and elegant open-source markdown editor that focused on speed and usability."
 arch=("x86_64")
@@ -13,7 +13,7 @@
 depends=('gtk3'  'libsecret'  'libxkbfile'  'libxss'  'nss')
 source=(
   "$url/releases/download/v$pkgver/$_pkgname-linux-$pkgver.deb")
-sha256sums=('e0eaa1967d6cd82e6f96a44766886c79b122a961709b1f1d26c1276b046c84d1')
+sha256sums=('60eb7f15920f8a6b3be0d3363c9447dafa7379935b1537ffe442e562083b70a3')
 
 build() {
   mkdir -p "${srcdir}/dpkgdir"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-03 07:52:31	Medium	2
2026-06-18 16:11:54	Clean	0