mindwtr-beta-bin

LOW

maintainer dongdongbh 0 votes scanned 2026-08-31 19:46:16.204478

View on AUR

Why flagged

The package downloads a prebuilt .deb from GitHub releases, which is a supply-chain risk if the source is compromised, but it is the official release channel for the project and the binary is from a tagged release.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt .deb from GitHub releases, which is a supply-chain risk if the source is compromised, but it is the official release channel for the project and the binary is from a tagged release.

PKGBUILD

      1# Maintainer: dongdongbh <dongdongbhbh@gmail.com>
    
      2pkgname=mindwtr-beta-bin
    
      3pkgver=1.2.5
    
      4epoch=1
    
      5pkgrel=1
    
      6pkgdesc="A complete Getting Things Done (GTD) productivity system - Mind Like Water (beta binary release)"
    
      7arch=('x86_64')
    
      8url="https://github.com/dongdongbh/Mindwtr"
    
      9license=('AGPL3')
    
      10depends=('webkit2gtk-4.1' 'gtk3' 'libappindicator-gtk3')
    
      11optdepends=('evolution-data-server: GNOME system calendar integration')
    
      12provides=('mindwtr' 'mindwtr-bin')
    
      13conflicts=('mindwtr' 'mindwtr-bin')
    
      14_release_tag=v1.2.5
    
      15_asset_version=1.2.5
    
      16source_x86_64=("${url}/releases/download/${_release_tag}/mindwtr_${_asset_version}_amd64.deb")
    
      17sha256sums_x86_64=('2a5bcc8670cd944cfcd7806f89241ced369ad2469255a61f397985a14a13d908')
    
      18
    
      19package() {
    
      20    tar -xf data.tar.zst -C "${pkgdir}" || tar -xf data.tar.gz -C "${pkgdir}"
    
      21}
    
      22

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-31 19:46:16	Low	2