meshcore-bin

MEDIUM

maintainer dreieck 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt binary from a non-standard host (files.liamcottle.net) which is not a widely recognized or official release platform, creating a supply-chain risk if the source were compromised.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:71 "https://files.liamcottle.net/MeshCore/v${_releasever}/MeshCore-v${_releasever}${_buildno:++"${_buildno}"}-${_githash}-linux-${CARCH}.zip"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt binary from a non-standard host (files.liamcottle.net) which is not a widely recognized or official release platform, creating a supply-chain risk if the source were compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  dreieck (https://aur.archlinux.org/account/dreieck)
    
      2
    
      3_pkgname="meshcore"
    
      4pkgname="${_pkgname}-bin"
    
      5## For up to date releases, see https://files.liamcottle.net/MeshCore/.
    
      6## Upstream versioning: e.g. `1.40.0+64-1abed0d` -- break down the individual elements to reference them later, too.
    
      7_releasever=1.49.0
    
      8_buildno=77
    
      9_githash=ac8ed11
    
      10pkgver="${_releasever}${_buildno:+.build"${_buildno}"}.${_githash}"
    
      11pkgrel=1
    
      12pkgdesc="Closed source reference companion app by Liam Cottle for MeshCore, a LoRa text messaging protocol."
    
      13groups=('meshcore')
    
      14arch=(
    
      15  'x86_64'
    
      16)
    
      17url="https://meshcore.co.uk/"
    
      18
    
      19
    
      20license=(
    
      21  "LicenseRef-Proprietary" # App itself.
    
      22  "CC-BY-SA-4.0"           # MeshCore_Quick_Start_Guide.pdf
    
      23  # Licenses of included libraries. They are in `data/flutter_assets/NOTICES.Z`.
    
      24  "Apache-2.0"
    
      25  "BSD-2-Clause"
    
      26  "BSD-3-Clause"
    
      27  "MIT"
    
      28  "MPL-2.0"
    
      29  "OpenSSL"
    
      30  "SSLeay-standalone"
    
      31)
    
      32depends=(
    
      33  # glib2
    
      34  libglib-2.0.so
    
      35  libgio-2.0.so
    
      36  libgobject-2.0.so
    
      37
    
      38  # gtk3
    
      39  libgdk-3.so
    
      40  libgtk-3.so
    
      41
    
      42  glibc
    
      43  libgcc_s.so
    
      44  libgdk_pixbuf-2.0.so
    
      45  libatk-1.0.so  # at-spi2-core
    
      46  libfontconfig.so
    
      47  libstdc++.so
    
      48  libcairo.so
    
      49  libcairo-gobject.so
    
      50  libharfbuzz.so
    
      51  libepoxy.so
    
      52  libpango-1.0.so
    
      53  libpangocairo-1.0.so
    
      54)
    
      55makedepends=(
    
      56  # To reduce the size of PNG images
    
      57  'parallel'
    
      58  'zopfli'
    
      59)
    
      60optdepends=(
    
      61  'hicolor-icon-theme: For hicolor theme hierarchy.'
    
      62)
    
      63provides=(
    
      64  "${_pkgname}=${pkgver}"
    
      65)
    
      66conflicts=(
    
      67  "${_pkgname}"
    
      68)
    
      69
    
      70source=(
    
      71  "https://files.liamcottle.net/MeshCore/v${_releasever}/MeshCore-v${_releasever}${_buildno:++"${_buildno}"}-${_githash}-linux-${CARCH}.zip"
    
      72  "https://files.liamcottle.net/MeshCore/Documentation/MeshCore_Quick_Start_Guide.pdf"
    
      73  "${_pkgname}.desktop"
    
      74  "license-info.md"
    
      75)
    
      76sha256sums=(
    
      77  '18426a2d756a5b4bab49b1b0db72f2a1aaaea33f7cfcc659441868707f6e8ec6'  # Binary software package.
    
      78  'a8bcb2a147746b1b0a3879220f5d55aac79c6b5f2b100fbc6b1ccea6c9946ca7'  # MeshCore_Quick_Start_Guide.pdf
    
      79  '3c212412360ca59e73a11af24b85db2d5414f2d5851f1a60267fca701077c921'  # meshcore.desktop
    
      80  '138cfaf059ef5c3fb860d3132291570179bf74cb77e1aaa7927fa766a93ad957'  # license-info.md
    
      81)
    
      82
    
      83build() {
    
      84  cd "${srcdir}"
    
      85
    
      86  printf '%s\n' " --> size-optimising PNG files ..."
    
      87  find -name '*.png' -type f | parallel -j`nproc` zopflipng -m -y {} {}
    
      88}
    
      89
    
      90package() {
    
      91  printf '%s\n' " --> installing ..."
    
      92
    
      93  cd "${srcdir}"
    
      94
    
      95  install -vm755 -d "${pkgdir}/usr/lib/meshcore"
    
      96  cp -rv data lib MeshCore "${pkgdir}/usr/lib/meshcore"/
    
      97  install -vm755 -d "${pkgdir}/usr/bin"
    
      98  cd "${pkgdir}/usr/bin"
    
      99  ln -sv /usr/lib/meshcore/MeshCore MeshCore
    
      100  ln -sv MeshCore meshcore
    
      101
    
      102
    
      103  printf '%s\n' " --> installing icon and desktop file ..."
    
      104
    
      105  cd "${srcdir}"
    
      106
    
      107  install -Dvm644  data/flutter_assets/assets/images/icon.png    "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${_pkgname}.png"
    
      108  install -dvm755  "${pkgdir}/usr/share/pixmaps"
    
      109  ln -sv "/usr/share/icons/hicolor/512x512/apps/${_pkgname}.png"  "${pkgdir}/usr/share/pixmaps/${_pkgname}.png"
    
      110  install -Dvm644 "${srcdir}/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      111
    
      112  _docfiles=(
    
      113    MeshCore_Quick_Start_Guide.pdf
    
      114    data/flutter_assets/CHANGELOG.md
    
      115  )
    
      116  _docdirs=()
    
      117  _manfiles=()
    
      118  _infofiles=()
    
      119  _licensefiles=(
    
      120    license-info.md
    
      121    data/flutter_assets/NOTICES.Z  # License for included libraries, not for the software itself.
    
      122  )
    
      123  printf '%s\n' " --> installing documentation ..."
    
      124  for _docfile in "${_docfiles[@]}"; do
    
      125    install -D -v -m644 "${_docfile}" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_docfile}")"
    
      126  done
    
      127  for _docdir in "${_docdirs[@]}"; do
    
      128    cp -rv "${_docdir}" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_docdir}")"
    
      129  done
    
      130  for _manfile in "${_manfiles[@]}"; do
    
      131    _section="$(basename "${_manfile}" .gz | sed -E -e 's|^.*\.([^.]*)$|\1|')"
    
      132    install -D -v -m644 "docs/build/man/${_manfile}" "${pkgdir}/usr/share/man/man${_section}/$(basename "${_manfile}")"
    
      133  done
    
      134  for _infofile in "${_infofiles[@]}"; do
    
      135    install -D -v -m644 "${_infofile}" "${pkgdir}/usr/share/info/$(basename "${_infofile}")"
    
      136  done
    
      137  printf '%s\n' " --> installing license ..."
    
      138  for _licensefile in "${_licensefiles[@]}"; do
    
      139    install -D -v -m644 "${_licensefile[@]}" "${pkgdir}/usr/share/licenses/${pkgname}/$(basename "${_licensefile}")"
    
      140    ln -svr "${pkgdir}/usr/share/licenses/${pkgname}/$(basename "${_licensefile}")" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_licensefile}")"
    
      141  done
    
      142}
    
      143
    
      144# vim: set sw=2 ts=2 et:
    
      145

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2