mind-elixir

MEDIUM

maintainer duanluan 0 votes scanned 2026-08-21 21:15:20.444724

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release, which is unverifiable and could be swapped by an attacker; while the source is from a project-owned repository, the use of a prebuilt .deb with a hardcoded checksum still poses a supply-chain risk if the release infrastructure is compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a GitHub release, which is unverifiable and could be swapped by an attacker; while the source is from a project-owned repository, the use of a prebuilt .deb with a hardcoded checksum still poses a supply-chain risk if the release infrastructure is compromised.

PKGBUILD

      1# Maintainer: duanluan <duanluan@outlook.com>
    
      2
    
      3pkgname=mind-elixir
    
      4_pkgname=mind-elixir
    
      5pkgver=1.10.3
    
      6pkgrel=1
    
      7pkgdesc='Lightweight privacy-focused mind mapping tool (prebuilt binary)'
    
      8arch=('x86_64')
    
      9url='https://app.mind-elixir.com/'
    
      10license=('NOASSERTION')
    
      11depends=('gtk3' 'hicolor-icon-theme' 'webkit2gtk-4.1')
    
      12provides=("mind-elixir-bin=${pkgver}")
    
      13options=('!strip')
    
      14source=("Mind.Elixir_${pkgver}_amd64.deb::https://github.com/SSShooter/Mind-Elixir-Desktop-Release/releases/download/app-v${pkgver}/Mind.Elixir_${pkgver}_amd64.deb")
    
      15sha256sums=('5f05f07c7d338e88dd4b78cd4680acee2e0c8407fbb7ecce48bc81ed952c863b')
    
      16
    
      17package() {
    
      18  local _extractdir
    
      19  _extractdir="$(mktemp -d)"
    
      20  trap 'rm -rf "${_extractdir}"' EXIT
    
      21
    
      22  bsdtar -C "${_extractdir}" -xf "${srcdir}/Mind.Elixir_${pkgver}_amd64.deb"
    
      23  bsdtar -C "${pkgdir}" -xf "${_extractdir}/data.tar.gz"
    
      24
    
      25  install -dm755 "${pkgdir}/usr/lib/${_pkgname}"
    
      26  mv "${pkgdir}/usr/bin/MindElixir" "${pkgdir}/usr/lib/${_pkgname}/MindElixir"
    
      27
    
      28  install -Dm755 /dev/stdin "${pkgdir}/usr/bin/mind-elixir" <<'SCRIPT'
    
      29#!/bin/sh
    
      30export WEBKIT_DISABLE_DMABUF_RENDERER="${WEBKIT_DISABLE_DMABUF_RENDERER:-1}"
    
      31exec /usr/lib/mind-elixir/MindElixir "$@"
    
      32SCRIPT
    
      33
    
      34  install -Dm755 /dev/stdin "${pkgdir}/usr/bin/MindElixir" <<'SCRIPT'
    
      35#!/bin/sh
    
      36exec /usr/bin/mind-elixir "$@"
    
      37SCRIPT
    
      38
    
      39  sed -i \
    
      40    -e 's|^Exec=.*|Exec=mind-elixir %U|' \
    
      41    -e 's|^Categories=.*|Categories=Office;Utility;|' \
    
      42    "${pkgdir}/usr/share/applications/Mind Elixir.desktop"
    
      43}
    
      44

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-21 21:15:20	Medium	2