mesh-client-bin

LOW

maintainer robertfoster 0 votes scanned 2026-09-14 00:27:57.913550

View on AUR

Why flagged

The package installs a prebuilt Electron binary from the project's official GitHub releases, which is a normal practice for AUR binary packages; the low severity is due to the binary nature and unverifiable origin beyond checksum, but it comes from the legitimate project source.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt Electron binary from the project's official GitHub releases, which is a normal practice for AUR binary packages; the low severity is due to the binary nature and unverifiable origin beyond checksum, but it comes from the legitimate project source.

PKGBUILD

      1# Maintainer: robertfoster
    
      2pkgname=mesh-client-bin
    
      3_pkgname="${pkgname%-bin}"
    
      4pkgver=5.36.0 # renovate: datasource=github-releases depName=Colorado-Mesh/mesh-client
    
      5pkgrel=1
    
      6pkgdesc="Electron desktop client for Meshtastic, MeshCore and Reticulum with BLE, USB serial, TCP and MQTT transports"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://github.com/Colorado-Mesh/mesh-client"
    
      9license=('GPL-3.0-or-later')
    
      10depends=('at-spi2-core' 'gcc-libs' 'glibc' 'gtk3' 'hicolor-icon-theme' 'libnotify'
    
      11  'libsecret' 'libxss' 'libxtst' 'nss' 'util-linux-libs' 'xdg-utils')
    
      12provides=("${_pkgname}")
    
      13conflicts=("${_pkgname}")
    
      14options=('!strip')
    
      15source_x86_64=("${pkgname}-${pkgver}-x86_64.deb::${url}/releases/download/v${pkgver}/${_pkgname}_${pkgver}_amd64.deb")
    
      16source_aarch64=("${pkgname}-${pkgver}-aarch64.deb::${url}/releases/download/v${pkgver}/${_pkgname}_${pkgver}_arm64.deb")
    
      17
    
      18prepare() {
    
      19  bsdtar -xf data.tar.* -C "${srcdir}"
    
      20
    
      21  # upstream points at its own /opt prefix and ships no keywords
    
      22  sed -i -e "s|^Exec=.*|Exec=${_pkgname} %U|" \
    
      23    -e '/^Categories=/s|Utility;|Network;Utility;|' \
    
      24    "${srcdir}/usr/share/applications/${_pkgname}.desktop"
    
      25}
    
      26
    
      27package() {
    
      28  install -d "${pkgdir}/usr/lib" "${pkgdir}/usr/bin"
    
      29  cp -a "${srcdir}/opt/Mesh-client" "${pkgdir}/usr/lib/${_pkgname}"
    
      30  ln -s "/usr/lib/${_pkgname}/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      31
    
      32  # Electron's SUID sandbox helper; without the bit the app refuses to start
    
      33  chmod 4755 "${pkgdir}/usr/lib/${_pkgname}/chrome-sandbox"
    
      34
    
      35  install -Dm644 "${srcdir}/usr/share/applications/${_pkgname}.desktop" \
    
      36    "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      37
    
      38  local _size
    
      39  for _size in 16 32 64 128 256; do
    
      40    install -Dm644 "${srcdir}/usr/share/icons/hicolor/${_size}x${_size}/apps/${_pkgname}.png" \
    
      41      "${pkgdir}/usr/share/icons/hicolor/${_size}x${_size}/apps/${_pkgname}.png"
    
      42  done
    
      43}
    
      44
    
      45sha256sums_x86_64=('3f08ccf109d8915bb29d3350fbe729b883ae43f77a7405cc32d398149387b39d')
    
      46sha256sums_aarch64=('970ca009405dd138ca0154ff9043f1415ae841ab4c89248070bbf7ecc2c57003')
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-14 00:27:57	Low	2
2026-09-13 23:15:25	Low	2