mesonotes-bin
MEDIUM
maintainer linuxmind
1 votes
scanned 2026-10-22 17:35:31.972993
Why flagged
The package installs a prebuilt binary from a generic GitLab package registry without a publicly verifiable build process, creating a supply-chain risk if the source were swapped.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Medium
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt binary from a generic GitLab package registry without a publicly verifiable build process, creating a supply-chain risk if the source were swapped.
PKGBUILD
1
# Maintainer: Mészáros Zoltán <contact.mesonotes@gmail.com>
2
pkgname=mesonotes-bin
3
pkgver=1.0.0
4
pkgrel=1
5
pkgdesc="Notes, tasks, boards, canvases and writing on your own computer"
6
arch=('x86_64')
7
url="https://linuxmind.gitlab.io/"
8
license=('GPL-3.0-or-later')
9
depends=('gtk3' 'nss' 'alsa-lib' 'libxss' 'libxtst' 'libnotify' 'at-spi2-core' 'xdg-utils' 'libsecret' 'util-linux-libs')
10
optdepends=('smbclient: backup and sync to a NAS (SMB share)')
11
provides=('mesonotes')
12
conflicts=('mesonotes')
13
options=('!strip' '!debug')
14
source=("mesonotes-${pkgver}-amd64.deb::https://gitlab.com/api/v4/projects/linuxmind%2Fmesonotes/packages/generic/mesonotes/${pkgver}/mesonotes-${pkgver}-amd64.deb")
15
sha256sums=('a5ebccfb9bff2618614f503520f13734203383b891f15cb06ad8f9edb16c79f0')
16
17
package() {
18
bsdtar -xf data.tar.xz -C "$pkgdir"
19
install -d "$pkgdir/usr/bin"
20
ln -s /opt/MesoNotes/mesonotes "$pkgdir/usr/bin/mesonotes"
21
}
22
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-22 17:35:31 | Medium | 2 |