marmalade-bin

maintainer MiguVT · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt binary from a GitHub release and model/data files from trusted domains; while the binary source is not whitelisted, it is from the project's official repository, and the installed files are consistent with the project's purpose, posing no evident execution risk beyond standard software installation.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from a GitHub release and model/data files from trusted domains; while the binary source is not whitelisted, it is from the project's official repository, and the installed files are consistent with the project's purpose, posing no evident execution risk beyond standard software installation.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 "face_landmarker.task::https://storage.googleapis.com/mediapipe-models/face_landmarker/face_landmarker/float16/latest/face_landmarker.task"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: MiguVT <contacto@miguvt.com>
    
      2
    
      3pkgname=marmalade-bin
    
      4pkgver=0.5.0
    
      5pkgrel=1
    
      6pkgdesc="MediaPipe tracking bridge for Linux with CLI, GTK3 and GTK4 binaries"
    
      7arch=('x86_64')
    
      8url="https://github.com/RanAwaySuccessfully/marmalade"
    
      9license=('MIT')
    
      10options=('!strip')
    
      11depends=('glibc' 'gtk3' 'gtk4' 'libv4l' 'xdg-utils' 'pciutils')
    
      12optdepends=('cuda: For NVIDIA GPU acceleration (highly recommended for RTX cards)'
    
      13            'cudnn: Required for CUDA-based neural network acceleration')
    
      14provides=('marmalade')
    
      15conflicts=('marmalade')
    
      16source=(
    
      17    "${pkgname}-${pkgver}.zip::https://github.com/RanAwaySuccessfully/marmalade/releases/download/v${pkgver}/marmalade.zip"
    
      18    "face_landmarker.task::https://storage.googleapis.com/mediapipe-models/face_landmarker/face_landmarker/float16/latest/face_landmarker.task"
    
      19    "marmalade_logo.svg::https://raw.githubusercontent.com/RanAwaySuccessfully/marmalade/refs/heads/main/resources/icons/marmalade_logo.svg"
    
      20    "marmalade_logo.png::https://raw.githubusercontent.com/RanAwaySuccessfully/marmalade/refs/heads/main/resources/icons/marmalade_logo.png"
    
      21    "marmalade_logo_256.png::https://raw.githubusercontent.com/RanAwaySuccessfully/marmalade/refs/heads/main/resources/icons/marmalade_logo_256.png"
    
      22)
    
      23sha256sums=('3f79dd87f9c5353e9ab70af7b41d8048070f5ef6ef60ff0fe79ab16909f9d3c3'
    
      24            '64184e229b263107bc2b804c6625db1341ff2bb731874b0bcc2fe6544e0bc9ff'
    
      25            '79bf9e5e2d08616e9e6977c08962ad9fcfde5589909d5eb95a11c00af4a6e447'
    
      26            'c719ba5b9c7592d6b709d22532ac784e9d98e706310d19e17740e1a749e71f7f'
    
      27            'aca4f58ad63f02ad32c9ffb9acc120694ce0bea23306abdf42d71f1ce05106ff')
    
      28
    
      29package() {
    
      30    install -d "${pkgdir}/usr/lib/marmalade"
    
      31    install -d "${pkgdir}/usr/share/marmalade"
    
      32    install -d "${pkgdir}/usr/bin"
    
      33
    
      34    install -Dm755 "${srcdir}/marmalade" "${pkgdir}/usr/lib/marmalade/marmalade"
    
      35    install -Dm755 "${srcdir}/marmalade-gtk3" "${pkgdir}/usr/lib/marmalade/marmalade-gtk3"
    
      36    install -Dm755 "${srcdir}/marmalade-gtk4" "${pkgdir}/usr/lib/marmalade/marmalade-gtk4"
    
      37    cp -a "${srcdir}/lib" "${pkgdir}/usr/lib/marmalade/"
    
      38    install -Dm644 "${srcdir}/config.json" "${pkgdir}/usr/share/marmalade/config.json"
    
      39
    
      40    cat > "${pkgdir}/usr/bin/marmalade" <<'EOF'
    
      41#!/bin/sh
    
      42state_dir="${XDG_CONFIG_HOME:-$HOME/.config}/marmalade"
    
      43mkdir -p "$state_dir"
    
      44
    
      45if [ ! -e "$state_dir/config.json" ]; then
    
      46    install -m 600 /usr/share/marmalade/config.json "$state_dir/config.json"
    
      47fi
    
      48
    
      49if [ ! -L "$state_dir/lib" ]; then
    
      50    rm -rf "$state_dir/lib"
    
      51    ln -s /usr/lib/marmalade/lib "$state_dir/lib"
    
      52fi
    
      53
    
      54cd "$state_dir" || exit 1
    
      55exec /usr/lib/marmalade/marmalade "$@"
    
      56EOF
    
      57
    
      58    cat > "${pkgdir}/usr/bin/marmalade-gtk3" <<'EOF'
    
      59#!/bin/sh
    
      60state_dir="${XDG_CONFIG_HOME:-$HOME/.config}/marmalade"
    
      61mkdir -p "$state_dir"
    
      62
    
      63if [ ! -e "$state_dir/config.json" ]; then
    
      64    install -m 600 /usr/share/marmalade/config.json "$state_dir/config.json"
    
      65fi
    
      66
    
      67if [ ! -L "$state_dir/lib" ]; then
    
      68    rm -rf "$state_dir/lib"
    
      69    ln -s /usr/lib/marmalade/lib "$state_dir/lib"
    
      70fi
    
      71
    
      72cd "$state_dir" || exit 1
    
      73exec /usr/lib/marmalade/marmalade-gtk3 "$@"
    
      74EOF
    
      75
    
      76    cat > "${pkgdir}/usr/bin/marmalade-gtk4" <<'EOF'
    
      77#!/bin/sh
    
      78state_dir="${XDG_CONFIG_HOME:-$HOME/.config}/marmalade"
    
      79mkdir -p "$state_dir"
    
      80
    
      81if [ ! -e "$state_dir/config.json" ]; then
    
      82    install -m 600 /usr/share/marmalade/config.json "$state_dir/config.json"
    
      83fi
    
      84
    
      85if [ ! -L "$state_dir/lib" ]; then
    
      86    rm -rf "$state_dir/lib"
    
      87    ln -s /usr/lib/marmalade/lib "$state_dir/lib"
    
      88fi
    
      89
    
      90cd "$state_dir" || exit 1
    
      91exec /usr/lib/marmalade/marmalade-gtk4 "$@"
    
      92EOF
    
      93
    
      94    chmod 755 "${pkgdir}/usr/bin/marmalade" \
    
      95              "${pkgdir}/usr/bin/marmalade-gtk3" \
    
      96              "${pkgdir}/usr/bin/marmalade-gtk4"
    
      97
    
      98    install -d "${pkgdir}/usr/share/applications"
    
      99    cat > "${pkgdir}/usr/share/applications/marmalade-gtk3.desktop" <<'EOF'
    
      100[Desktop Entry]
    
      101Type=Application
    
      102Name=Marmalade (GTK 3)
    
      103Comment=MediaPipe tracking bridge for Linux
    
      104Exec=marmalade-gtk3
    
      105Icon=xyz.randev.marmalade
    
      106Terminal=false
    
      107Categories=Utility;Video;
    
      108StartupNotify=true
    
      109EOF
    
      110
    
      111    cat > "${pkgdir}/usr/share/applications/marmalade-gtk4.desktop" <<'EOF'
    
      112[Desktop Entry]
    
      113Type=Application
    
      114Name=Marmalade (GTK 4)
    
      115Comment=MediaPipe tracking bridge for Linux
    
      116Exec=marmalade-gtk4
    
      117Icon=xyz.randev.marmalade
    
      118Terminal=false
    
      119Categories=Utility;Video;
    
      120StartupNotify=true
    
      121EOF
    
      122
    
      123    install -Dm644 "${srcdir}/marmalade_logo.svg" \
    
      124        "${pkgdir}/usr/share/icons/hicolor/scalable/apps/xyz.randev.marmalade.svg"
    
      125    install -Dm644 "${srcdir}/marmalade_logo_256.png" \
    
      126        "${pkgdir}/usr/share/icons/hicolor/256x256/apps/xyz.randev.marmalade.png"
    
      127    install -Dm644 "${srcdir}/marmalade_logo.png" \
    
      128        "${pkgdir}/usr/share/pixmaps/xyz.randev.marmalade.png"
    
      129
    
      130    install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      131}
    
      132

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2