meo-account-bin

MEDIUM

maintainer Shekong 0 votes scanned 2026-10-26 01:45:57.641994

View on AUR

Why flagged

Downloads and installs a prebuilt binary package directly from packages.meoarch.org (a non-official, project-specific but unverifiable personal/distro repository), bypassing normal package manager verification; while a SHA256 checksum is provided, the binary is not from a widely-trusted source and could be silently swapped if the host is compromised or controlled by an unrelated party.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=('meo-account-0.1.0-11-x86_64.pkg.tar.zst::https://packages.meoarch.org/meo/os/x86_64/meo-account-0.1.0-11-x86_64.pkg.tar.zst')

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 80%): Downloads and installs a prebuilt binary package directly from packages.meoarch.org (a non-official, project-specific but unverifiable personal/distro repository), bypassing normal package manager verification; while a SHA256 checksum is provided, the binary is not from a widely-trusted source and could be silently swapped if the host is compromised or controlled by an unrelated party.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: MeoArch <https://github.com/QwQdoge>
    
      2pkgname=meo-account-bin
    
      3_pkgname=meo-account
    
      4pkgver=0.1.0
    
      5pkgrel=11
    
      6pkgdesc="Meo Account broker and authentication dialog for MeoArch (prebuilt)"
    
      7arch=('x86_64')
    
      8url='https://github.com/QwQdoge/MeoArch-account'
    
      9license=('GPL-3.0-or-later')
    
      10depends=('qt6-base' 'qt6-declarative' 'kwallet' 'meoui-qml>=1.0.4beta1')
    
      11provides=('meo-account=0.1.0-11')
    
      12conflicts=('meo-account')
    
      13backup=('etc/meo-account/broker.conf')
    
      14options=('!strip' '!debug')
    
      15source=('meo-account-0.1.0-11-x86_64.pkg.tar.zst::https://packages.meoarch.org/meo/os/x86_64/meo-account-0.1.0-11-x86_64.pkg.tar.zst')
    
      16noextract=('meo-account-0.1.0-11-x86_64.pkg.tar.zst')
    
      17sha256sums=('d4b4539b818aaf82e94e2d39ca9892403569b78f3a1d182b2dcdc715f90b045b')
    
      18
    
      19package() {
    
      20  bsdtar -xf "$srcdir/meo-account-0.1.0-11-x86_64.pkg.tar.zst" -C "$pkgdir" --exclude=.PKGINFO --exclude=.BUILDINFO --exclude=.MTREE --exclude=.INSTALL --exclude=.CHANGELOG
    
      21}
    
      22

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-26 01:45:57	Medium	3
2026-10-26 01:43:34	Medium	3