mcomix-rs

maintainer rippathehutt · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package installs a prebuilt binary from the project's official GitHub releases, which is a normal practice for AUR packages; the source of the binary is transparent and matches the project's own release infrastructure, posing no inherent risk beyond standard trust in the upstream developer.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from the project's official GitHub releases, which is a normal practice for AUR packages; the source of the binary is transparent and matches the project's own release infrastructure, posing no inherent risk beyond standard trust in the upstream developer.

PKGBUILD

      1# Maintainer: Rippa The Hutt <iacoporippagmail@duck.com>
    
      2# Binary package: downloads the prebuilt Linux artifact from the GitHub
    
      3# release and installs it (no compilation). Bump pkgver to match a published
    
      4# release tag (e.g. v0.1.0).
    
      5
    
      6pkgname=mcomix-rs
    
      7pkgver=0.2.0
    
      8pkgrel=1
    
      9pkgdesc="A user-friendly, customizable comic book image viewer (Rust/GTK4 port)"
    
      10arch=('x86_64')
    
      11url="https://github.com/rippa-the-hutt/mcomix-rs"
    
      12license=('GPL2')
    
      13# mcomix-rs supersedes the Python mcomix3 package (same icons/desktop files).
    
      14conflicts=('mcomix3')
    
      15replaces=('mcomix3')
    
      16depends=(
    
      17    'gtk4'
    
      18    'gdk-pixbuf2'
    
      19    'glib2'
    
      20    'pango'
    
      21    'cairo'
    
      22    'xz'
    
      23    'bzip2'
    
      24)
    
      25optdepends=(
    
      26    'unrar: for CBR/RAR archive support'
    
      27    'p7zip: for 7Zip/LHA archive support'
    
      28    'mupdf-tools: for PDF support'
    
      29)
    
      30source=(
    
      31    # The prebuilt x86_64 Linux binary from the release.
    
      32    "mcomix-rs-${pkgver}-x86_64-unknown-linux-gnu.tar.gz::https://github.com/rippa-the-hutt/mcomix-rs/releases/download/v${pkgver}/mcomix-rs-${pkgver}-x86_64-unknown-linux-gnu.tar.gz"
    
      33    # The source archive at the same tag, for the .desktop/MIME/icons.
    
      34    "mcomix-rs-src-${pkgver}.tar.gz::https://github.com/rippa-the-hutt/mcomix-rs/archive/refs/tags/v${pkgver}.tar.gz"
    
      35)
    
      36# Hashes are pinned for the current pkgver. When bumping pkgver to a new
    
      37# release, regenerate them with:  updkgsums
    
      38sha256sums=('07486ff212955e26ef354c98e17e3d323a801612dd99d25de39be4fb26e6e884'
    
      39            '1671e0d003f1886992cbf9805116baa52115812b5074f2603c4d59bcbc751d76')
    
      40
    
      41package() {
    
      42    # Binary from the release artifact.
    
      43    install -Dm755 "${srcdir}/mcomix-rs" "${pkgdir}/usr/bin/mcomix-rs"
    
      44
    
      45    # Data files from the source archive (locate it robustly; GitHub archive
    
      46    # dirs are named <repo>-<tag>).
    
      47    local linuxdir
    
      48    linuxdir="$(dirname "$(find "${srcdir}" -path '*/packaging/linux/mcomix-rs.desktop' | head -1)")"
    
      49
    
      50    install -Dm644 "${linuxdir}/mcomix-rs.desktop" \
    
      51        "${pkgdir}/usr/share/applications/mcomix-rs.desktop"
    
      52    install -Dm644 "${linuxdir}/mcomix-rs.xml" \
    
      53        "${pkgdir}/usr/share/mime/packages/mcomix-rs.xml"
    
      54
    
      55    for d in 16x16 22x22 24x24 32x32 48x48 256x256; do
    
      56        install -Dm644 "${linuxdir}/icons/${d}/apps/mcomix3.png" \
    
      57            "${pkgdir}/usr/share/icons/hicolor/${d}/apps/mcomix3.png" 2>/dev/null || true
    
      58        for mime in application-x-cbz application-x-cbr application-x-cbt; do
    
      59            install -Dm644 "${linuxdir}/icons/${d}/mimetypes/${mime}.png" \
    
      60                "${pkgdir}/usr/share/icons/hicolor/${d}/mimetypes/${mime}.png" 2>/dev/null || true
    
      61        done
    
      62    done
    
      63}
    
      64
    
      65post_install() {
    
      66    update-desktop-database -q 2>/dev/null || true
    
      67    update-mime-database /usr/share/mime 2>/dev/null || true
    
      68    gtk-update-icon-cache -q -t -f /usr/share/icons/hicolor 2>/dev/null || true
    
      69}
    
      70
    
      71post_upgrade() {
    
      72    post_install
    
      73}
    
      74

Changes since previous scan

--- PKGBUILD @ 2026-08-13 17:26
+++ PKGBUILD @ 2026-08-18 00:03
@@ -4,7 +4,7 @@
 # release tag (e.g. v0.1.0).
 
 pkgname=mcomix-rs
-pkgver=0.1.0
+pkgver=0.2.0
 pkgrel=1
 pkgdesc="A user-friendly, customizable comic book image viewer (Rust/GTK4 port)"
 arch=('x86_64')
@@ -35,10 +35,8 @@
 )
 # Hashes are pinned for the current pkgver. When bumping pkgver to a new
 # release, regenerate them with:  updkgsums
-sha256sums=(
-    'cc2e4a2125630a0fd82844d5044fe8d9117820351df33b50b3e64611714d3de9'
-    '18097fdc6e6f3fe8a492b55ba420c263869a0622693d620b818dc6592fbe62ae'
-)
+sha256sums=('07486ff212955e26ef354c98e17e3d323a801612dd99d25de39be4fb26e6e884'
+            '1671e0d003f1886992cbf9805116baa52115812b5074f2603c4d59bcbc751d76')
 
 package() {
     # Binary from the release artifact.

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 19:26:43	LOW	2
2026-08-13 17:26:33	LOW	1
2026-08-13 15:26:23	LOW	1