memory-card-bin

maintainer Sluicee · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt binary .deb from a GitHub release, which is an unverifiable executable artifact that could be swapped by an attacker; although from a project-owned repository, the lack of source build and use of a binary package creates a supply-chain risk.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt binary .deb from a GitHub release, which is an unverifiable executable artifact that could be swapped by an attacker; although from a project-owned repository, the lack of source build and use of a binary package creates a supply-chain risk.

PKGBUILD

      1# Maintainer: Sluicee <sluicee1@gmail.com>
    
      2
    
      3pkgname=memory-card-bin
    
      4pkgver=1.4.0
    
      5pkgrel=1
    
      6pkgdesc="A desktop music player with a retro PS2/CRT aesthetic"
    
      7arch=('x86_64')
    
      8url="https://github.com/Sluicee/memory-card"
    
      9license=('MIT')
    
      10depends=('webkit2gtk-4.1' 'gtk3' 'cairo' 'gdk-pixbuf2' 'glib2' 'libsoup3' 'alsa-lib' 'openssl' 'ffmpeg' 'gst-plugins-good' 'gst-plugins-base')
    
      11optdepends=('ttf-dejavu: fallback symbols/icons support' 'noto-fonts: fallback symbols/icons support')
    
      12options=('!debug')
    
      13provides=('memory-card')
    
      14conflicts=('memory-card')
    
      15source=("$pkgname-$pkgver.deb::$url/releases/download/v$pkgver/Memory.Card_${pkgver}_amd64.deb")
    
      16sha256sums=('281b1662c3e741a0be9a97c54b203ec2e4b065f9f896cca29d84de3f4ba01205')
    
      17package() {
    
      18  # Extract the payload data archive to the package directory
    
      19  if [ -f "$srcdir/data.tar.gz" ]; then
    
      20    bsdtar -xf "$srcdir/data.tar.gz" -C "$pkgdir/"
    
      21  elif [ -f "$srcdir/data.tar.xz" ]; then
    
      22    bsdtar -xf "$srcdir/data.tar.xz" -C "$pkgdir/"
    
      23  elif [ -f "$srcdir/data.tar.zst" ]; then
    
      24    bsdtar -xf "$srcdir/data.tar.zst" -C "$pkgdir/"
    
      25  else
    
      26    echo "Error: No data.tar archive found in source"
    
      27    return 1
    
      28  fi
    
      29
    
      30  # Remove bundled ffmpeg binary to use system's ffmpeg package instead of conflicting
    
      31  rm -f "$pkgdir/usr/bin/ffmpeg"
    
      32
    
      33  # Rename desktop file to match Wayland app_id (com.sluic.memory-card)
    
      34  if [ -f "$pkgdir/usr/share/applications/Memory Card.desktop" ]; then
    
      35    mv "$pkgdir/usr/share/applications/Memory Card.desktop" "$pkgdir/usr/share/applications/com.sluic.memory-card.desktop"
    
      36  fi
    
      37
    
      38  # Fix empty Categories and set absolute Icon path in the desktop file
    
      39  if [ -f "$pkgdir/usr/share/applications/com.sluic.memory-card.desktop" ]; then
    
      40    sed -i 's/^Categories=$/Categories=AudioVideo;Audio;Player;/' "$pkgdir/usr/share/applications/com.sluic.memory-card.desktop"
    
      41    sed -i 's|^Icon=.*|Icon=/usr/share/pixmaps/memory-card.png|' "$pkgdir/usr/share/applications/com.sluic.memory-card.desktop"
    
      42  fi
    
      43
    
      44  # Copy icon to pixmaps as a bulletproof fallback for custom icon themes
    
      45  if [ -f "$pkgdir/usr/share/icons/hicolor/512x512/apps/memory-card.png" ]; then
    
      46    mkdir -p "$pkgdir/usr/share/pixmaps"
    
      47    cp "$pkgdir/usr/share/icons/hicolor/512x512/apps/memory-card.png" "$pkgdir/usr/share/pixmaps/memory-card.png"
    
      48  fi
    
      49}
    
      50

Changes since previous scan

--- PKGBUILD @ 2026-08-01 00:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: Sluicee <sluicee1@gmail.com>
 
 pkgname=memory-card-bin
-pkgver=1.3.7
+pkgver=1.4.0
 pkgrel=1
 pkgdesc="A desktop music player with a retro PS2/CRT aesthetic"
 arch=('x86_64')
@@ -13,7 +13,7 @@
 provides=('memory-card')
 conflicts=('memory-card')
 source=("$pkgname-$pkgver.deb::$url/releases/download/v$pkgver/Memory.Card_${pkgver}_amd64.deb")
-sha256sums=('3596baf91fb00a8ba8521f190ac999ffce77c4ab1bfc1f42c7f0cd729191354b')
+sha256sums=('281b1662c3e741a0be9a97c54b203ec2e4b065f9f896cca29d84de3f4ba01205')
 package() {
   # Extract the payload data archive to the package directory
   if [ -f "$srcdir/data.tar.gz" ]; then

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 11:20:22	MEDIUM	2
2026-08-01 09:20:18	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 15:24:42	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 19:21:42	MEDIUM	2
2026-07-22 17:21:24	MEDIUM	2