meshcore-bin

maintainer dreieck · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary from a non-standard host (files.liamcottle.net) which is not a widely recognized or official distribution platform, creating a supply-chain risk if the host or file is compromised.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:71 "https://files.liamcottle.net/MeshCore/v${_releasever}/MeshCore-v${_releasever}${_buildno:++"${_buildno}"}-${_githash}-linux-${CARCH}.zip"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt binary from a non-standard host (files.liamcottle.net) which is not a widely recognized or official distribution platform, creating a supply-chain risk if the host or file is compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  dreieck (https://aur.archlinux.org/account/dreieck)
    
      2
    
      3_pkgname="meshcore"
    
      4pkgname="${_pkgname}-bin"
    
      5## For up to date releases, see https://files.liamcottle.net/MeshCore/.
    
      6## Upstream versioning: e.g. `1.40.0+64-1abed0d` -- break down the individual elements to reference them later, too.
    
      7_releasever=1.47.0
    
      8_buildno=74
    
      9_githash=b68551d
    
      10pkgver="${_releasever}${_buildno:+.build"${_buildno}"}.${_githash}"
    
      11pkgrel=1
    
      12pkgdesc="Closed source reference companion app by Liam Cottle for MeshCore, a LoRa text messaging protocol."
    
      13groups=('meshcore')
    
      14arch=(
    
      15  'x86_64'
    
      16)
    
      17url="https://meshcore.co.uk/"
    
      18
    
      19
    
      20license=(
    
      21  "LicenseRef-Proprietary" # App itself.
    
      22  "CC-BY-SA-4.0"           # MeshCore_Quick_Start_Guide.pdf
    
      23  # Licenses of included libraries. They are in `data/flutter_assets/NOTICES.Z`.
    
      24  "Apache-2.0"
    
      25  "BSD-2-Clause"
    
      26  "BSD-3-Clause"
    
      27  "MIT"
    
      28  "MPL-2.0"
    
      29  "OpenSSL"
    
      30  "SSLeay-standalone"
    
      31)
    
      32depends=(
    
      33  # glib2
    
      34  libglib-2.0.so
    
      35  libgio-2.0.so
    
      36  libgobject-2.0.so
    
      37
    
      38  # gtk3
    
      39  libgdk-3.so
    
      40  libgtk-3.so
    
      41
    
      42  glibc
    
      43  libgcc_s.so
    
      44  libgdk_pixbuf-2.0.so
    
      45  libatk-1.0.so  # at-spi2-core
    
      46  libfontconfig.so
    
      47  libstdc++.so
    
      48  libcairo.so
    
      49  libcairo-gobject.so
    
      50  libharfbuzz.so
    
      51  libepoxy.so
    
      52  libpango-1.0.so
    
      53  libpangocairo-1.0.so
    
      54)
    
      55makedepends=(
    
      56  # To reduce the size of PNG images
    
      57  'parallel'
    
      58  'zopfli'
    
      59)
    
      60optdepends=(
    
      61  'hicolor-icon-theme: For hicolor theme hierarchy.'
    
      62)
    
      63provides=(
    
      64  "${_pkgname}=${pkgver}"
    
      65)
    
      66conflicts=(
    
      67  "${_pkgname}"
    
      68)
    
      69
    
      70source=(
    
      71  "https://files.liamcottle.net/MeshCore/v${_releasever}/MeshCore-v${_releasever}${_buildno:++"${_buildno}"}-${_githash}-linux-${CARCH}.zip"
    
      72  "https://files.liamcottle.net/MeshCore/Documentation/MeshCore_Quick_Start_Guide.pdf"
    
      73  "${_pkgname}.desktop"
    
      74  "license-info.md"
    
      75)
    
      76sha256sums=(
    
      77  '43d18fff4738a3f2169485a4c56075b40f8b20ed43a844816a1ae399a243a4d8'  # Binary software package.
    
      78  'a8bcb2a147746b1b0a3879220f5d55aac79c6b5f2b100fbc6b1ccea6c9946ca7'  # MeshCore_Quick_Start_Guide.pdf
    
      79  '3c212412360ca59e73a11af24b85db2d5414f2d5851f1a60267fca701077c921'  # meshcore.desktop
    
      80  '138cfaf059ef5c3fb860d3132291570179bf74cb77e1aaa7927fa766a93ad957'  # license-info.md
    
      81)
    
      82
    
      83build() {
    
      84  cd "${srcdir}"
    
      85
    
      86  printf '%s\n' " --> size-optimising PNG files ..."
    
      87  find -name '*.png' -type f | parallel -j`nproc` zopflipng -m -y {} {}
    
      88}
    
      89
    
      90package() {
    
      91  printf '%s\n' " --> installing ..."
    
      92
    
      93  cd "${srcdir}"
    
      94
    
      95  install -vm755 -d "${pkgdir}/usr/lib/meshcore"
    
      96  cp -rv data lib MeshCore "${pkgdir}/usr/lib/meshcore"/
    
      97  install -vm755 -d "${pkgdir}/usr/bin"
    
      98  cd "${pkgdir}/usr/bin"
    
      99  ln -sv /usr/lib/meshcore/MeshCore MeshCore
    
      100  ln -sv MeshCore meshcore
    
      101
    
      102
    
      103  printf '%s\n' " --> installing icon and desktop file ..."
    
      104
    
      105  cd "${srcdir}"
    
      106
    
      107  install -Dvm644  data/flutter_assets/assets/images/icon.png    "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${_pkgname}.png"
    
      108  install -dvm755  "${pkgdir}/usr/share/pixmaps"
    
      109  ln -sv "/usr/share/icons/hicolor/512x512/apps/${_pkgname}.png"  "${pkgdir}/usr/share/pixmaps/${_pkgname}.png"
    
      110  install -Dvm644 "${srcdir}/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      111
    
      112  _docfiles=(
    
      113    MeshCore_Quick_Start_Guide.pdf
    
      114    data/flutter_assets/CHANGELOG.md
    
      115  )
    
      116  _docdirs=()
    
      117  _manfiles=()
    
      118  _infofiles=()
    
      119  _licensefiles=(
    
      120    license-info.md
    
      121    data/flutter_assets/NOTICES.Z  # License for included libraries, not for the software itself.
    
      122  )
    
      123  printf '%s\n' " --> installing documentation ..."
    
      124  for _docfile in "${_docfiles[@]}"; do
    
      125    install -D -v -m644 "${_docfile}" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_docfile}")"
    
      126  done
    
      127  for _docdir in "${_docdirs[@]}"; do
    
      128    cp -rv "${_docdir}" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_docdir}")"
    
      129  done
    
      130  for _manfile in "${_manfiles[@]}"; do
    
      131    _section="$(basename "${_manfile}" .gz | sed -E -e 's|^.*\.([^.]*)$|\1|')"
    
      132    install -D -v -m644 "docs/build/man/${_manfile}" "${pkgdir}/usr/share/man/man${_section}/$(basename "${_manfile}")"
    
      133  done
    
      134  for _infofile in "${_infofiles[@]}"; do
    
      135    install -D -v -m644 "${_infofile}" "${pkgdir}/usr/share/info/$(basename "${_infofile}")"
    
      136  done
    
      137  printf '%s\n' " --> installing license ..."
    
      138  for _licensefile in "${_licensefiles[@]}"; do
    
      139    install -D -v -m644 "${_licensefile[@]}" "${pkgdir}/usr/share/licenses/${pkgname}/$(basename "${_licensefile}")"
    
      140    ln -svr "${pkgdir}/usr/share/licenses/${pkgname}/$(basename "${_licensefile}")" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_licensefile}")"
    
      141  done
    
      142}
    
      143
    
      144# vim: set sw=2 ts=2 et:
    
      145

Changes since previous scan

--- PKGBUILD @ 2026-07-29 00:25
+++ PKGBUILD @ 2026-08-03 00:08
@@ -4,9 +4,9 @@
 pkgname="${_pkgname}-bin"
 ## For up to date releases, see https://files.liamcottle.net/MeshCore/.
 ## Upstream versioning: e.g. `1.40.0+64-1abed0d` -- break down the individual elements to reference them later, too.
-_releasever=1.46.0
-_buildno=73
-_githash=4d53700
+_releasever=1.47.0
+_buildno=74
+_githash=b68551d
 pkgver="${_releasever}${_buildno:+.build"${_buildno}"}.${_githash}"
 pkgrel=1
 pkgdesc="Closed source reference companion app by Liam Cottle for MeshCore, a LoRa text messaging protocol."
@@ -74,7 +74,7 @@
   "license-info.md"
 )
 sha256sums=(
-  '1f4543d64c395c20a517e47adb4e68857cf0cfb616e35091a1829bb80f177ef0'  # Binary software package.
+  '43d18fff4738a3f2169485a4c56075b40f8b20ed43a844816a1ae399a243a4d8'  # Binary software package.
   'a8bcb2a147746b1b0a3879220f5d55aac79c6b5f2b100fbc6b1ccea6c9946ca7'  # MeshCore_Quick_Start_Guide.pdf
   '3c212412360ca59e73a11af24b85db2d5414f2d5851f1a60267fca701077c921'  # meshcore.desktop
   '138cfaf059ef5c3fb860d3132291570179bf74cb77e1aaa7927fa766a93ad957'  # license-info.md

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 21:12:47	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2