mcomix-rs-bin

maintainer rippathehutt · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package downloads a prebuilt binary from the project's official GitHub releases, which is a common AUR pattern; while the binary is not locally built, the source is verifiable and from a trusted project host, limiting supply-chain risk to the project maintainer's account compromise.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt binary from the project's official GitHub releases, which is a common AUR pattern; while the binary is not locally built, the source is verifiable and from a trusted project host, limiting supply-chain risk to the project maintainer's account compromise.

PKGBUILD

      1# Maintainer: Rippa The Hutt <iacoporippagmail@duck.com>
    
      2# Binary package: downloads the prebuilt Linux artifact from the GitHub
    
      3# release and installs it (no compilation). Bump pkgver to match a published
    
      4# release tag (e.g. v0.1.0).
    
      5
    
      6pkgname=mcomix-rs-bin
    
      7pkgver=0.4.0
    
      8pkgrel=1
    
      9pkgdesc="A user-friendly, customizable comic book image viewer (Rust/GTK4 port)"
    
      10arch=('x86_64')
    
      11url="https://github.com/rippa-the-hutt/mcomix-rs"
    
      12license=('GPL2')
    
      13depends=(
    
      14    'gtk4'
    
      15    'gdk-pixbuf2'
    
      16    'glib2'
    
      17    'pango'
    
      18    'cairo'
    
      19    'xz'
    
      20    'bzip2'
    
      21)
    
      22optdepends=(
    
      23    'unrar: for CBR/RAR archive support'
    
      24    'p7zip: for 7Zip/LHA archive support'
    
      25    'mupdf-tools: for PDF support'
    
      26)
    
      27source=(
    
      28    # The prebuilt x86_64 Linux binary from the release.
    
      29    "mcomix-rs-${pkgver}-x86_64-unknown-linux-gnu.tar.gz::https://github.com/rippa-the-hutt/mcomix-rs/releases/download/v${pkgver}/mcomix-rs-${pkgver}-x86_64-unknown-linux-gnu.tar.gz"
    
      30    # The source archive at the same tag, for the .desktop/MIME/icons.
    
      31    "mcomix-rs-src-${pkgver}.tar.gz::https://github.com/rippa-the-hutt/mcomix-rs/archive/refs/tags/v${pkgver}.tar.gz"
    
      32)
    
      33# Hashes are pinned for the current pkgver. When bumping pkgver to a new
    
      34# release, regenerate them with:  updkgsums
    
      35sha256sums=('6671c891d37e9f179d16fa66eeb6ce95b7abec90eb7624b2545bcf35d1f6f594'
    
      36            'd40e43d638606ae6a5bf76f64ff2ff697aad4b40d327eecccefbd28e4e7f6f22')
    
      37
    
      38package() {
    
      39    # Binary from the release artifact.
    
      40    install -Dm755 "${srcdir}/mcomix-rs" "${pkgdir}/usr/bin/mcomix-rs"
    
      41
    
      42    # Data files from the source archive (locate it robustly; GitHub archive
    
      43    # dirs are named <repo>-<tag>).
    
      44    local linuxdir
    
      45    linuxdir="$(dirname "$(find "${srcdir}" -path '*/packaging/linux/mcomix-rs.desktop' | head -1)")"
    
      46
    
      47    install -Dm644 "${linuxdir}/mcomix-rs.desktop" \
    
      48        "${pkgdir}/usr/share/applications/mcomix-rs.desktop"
    
      49    install -Dm644 "${linuxdir}/mcomix-rs.xml" \
    
      50        "${pkgdir}/usr/share/mime/packages/mcomix-rs.xml"
    
      51
    
      52    for d in 16x16 22x22 24x24 32x32 48x48 256x256; do
    
      53        install -Dm644 "${linuxdir}/icons/${d}/apps/mcomix-rs.png" \
    
      54            "${pkgdir}/usr/share/icons/hicolor/${d}/apps/mcomix-rs.png" 2>/dev/null || true
    
      55        for mime in application-x-mcomix-cbz application-x-mcomix-cbr application-x-mcomix-cbt; do
    
      56            install -Dm644 "${linuxdir}/icons/${d}/mimetypes/${mime}.png" \
    
      57                "${pkgdir}/usr/share/icons/hicolor/${d}/mimetypes/${mime}.png" 2>/dev/null || true
    
      58        done
    
      59    done
    
      60}
    
      61
    
      62post_install() {
    
      63    update-desktop-database -q 2>/dev/null || true
    
      64    update-mime-database /usr/share/mime 2>/dev/null || true
    
      65    gtk-update-icon-cache -q -t -f /usr/share/icons/hicolor 2>/dev/null || true
    
      66}
    
      67
    
      68post_upgrade() {
    
      69    post_install
    
      70}
    
      71

Changes since previous scan

--- PKGBUILD @ 2026-08-16 00:03
+++ PKGBUILD @ 2026-08-18 00:03
@@ -4,7 +4,7 @@
 # release tag (e.g. v0.1.0).
 
 pkgname=mcomix-rs-bin
-pkgver=0.3.2
+pkgver=0.4.0
 pkgrel=1
 pkgdesc="A user-friendly, customizable comic book image viewer (Rust/GTK4 port)"
 arch=('x86_64')
@@ -32,8 +32,8 @@
 )
 # Hashes are pinned for the current pkgver. When bumping pkgver to a new
 # release, regenerate them with:  updkgsums
-sha256sums=('60eb11aed89592d1b1e865cabfb91216d6a9a313114b1bc3a5117fdb69742610'
-            '335243fd766c0aae008a91c6138c92a5d8e25ca3ee95e4d24948a54510707d8f')
+sha256sums=('6671c891d37e9f179d16fa66eeb6ce95b7abec90eb7624b2545bcf35d1f6f594'
+            'd40e43d638606ae6a5bf76f64ff2ff697aad4b40d327eecccefbd28e4e7f6f22')
 
 package() {
     # Binary from the release artifact.

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 09:35:23	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 17:33:23	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 17:30:51	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 11:29:14	LOW	2
2026-08-14 05:27:47	LOW	2