minot-bin
MEDIUM
maintainer stelzo
0 votes
scanned 2026-10-07 00:21:34.957174
Why flagged
The package downloads prebuilt .deb binaries from a non-standard, personal package archive (ppa.steado.tech), which is not a widely recognized or official distribution point, and the checksums are skipped, making the binaries unverifiable and potentially swappable by a third party.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:13
"$pkgname-$pkgver-bin.deb::https://ppa.steado.tech/ubuntu/pool/main/noble/minot_$pkgver-1_amd64.deb"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt .deb binaries from a non-standard, personal package archive (ppa.steado.tech), which is not a widely recognized or official distribution point, and the checksums are skipped, making the binaries unverifiable and potentially swappable by a third party.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: stelzo <stelzo@steado.de>
2
pkgname=minot-bin
3
pkgver=0.12.0
4
pkgrel=6
5
pkgdesc="A versatile toolset for debugging and verifying stateful robot perception software."
6
arch=('x86_64' 'aarch64')
7
url="https://codeberg.org/stelzo/minot"
8
license=('MIT' 'Apache-2.0')
9
depends=('libgcc' 'glibc')
10
makedepends=()
11
options=('!lto' '!strip' '!debug')
12
source_x86_64=(
13
"$pkgname-$pkgver-bin.deb::https://ppa.steado.tech/ubuntu/pool/main/noble/minot_$pkgver-1_amd64.deb"
14
"$pkgname-$pkgver-dev.deb::https://ppa.steado.tech/ubuntu/pool/main/noble/librat-dev_$pkgver-1_amd64.deb"
15
)
16
sha256sums_x86_64=('SKIP' 'SKIP')
17
source_aarch64=(
18
"$pkgname-$pkgver-bin.deb::https://ppa.steado.tech/ubuntu/pool/main/noble/minot_$pkgver-1_arm64.deb"
19
"$pkgname-$pkgver-dev.deb::https://ppa.steado.tech/ubuntu/pool/main/noble/librat-dev_$pkgver-1_arm64.deb"
20
)
21
sha256sums_aarch64=('SKIP' 'SKIP')
22
noextract=("$pkgname-$pkgver-bin.deb" "$pkgname-$pkgver-dev.deb")
23
provides=('minot' 'librat')
24
conflicts=('minot' 'librat')
25
26
prepare() {
27
mkdir -p "$srcdir/minot-bin-ext" "$srcdir/minot-dev-ext"
28
29
cd "$srcdir/minot-bin-ext"
30
bsdtar -xf "$srcdir/$pkgname-$pkgver-bin.deb"
31
tar -xpf data.tar.*
32
33
cd "$srcdir/minot-dev-ext"
34
bsdtar -xf "$srcdir/$pkgname-$pkgver-dev.deb"
35
tar -xpf data.tar.*
36
}
37
38
build() {
39
MINOT_CLI_PATH="$srcdir/minot-bin-ext/usr/bin/minot"
40
mkdir -p "$srcdir/completions"
41
"$MINOT_CLI_PATH" completions bash > "$srcdir/completions/bash"
42
"$MINOT_CLI_PATH" completions zsh > "$srcdir/completions/_zsh"
43
"$MINOT_CLI_PATH" completions fish > "$srcdir/completions/fish"
44
}
45
46
package() {
47
install -Dm755 "$srcdir/minot-bin-ext/usr/bin/minot" "$pkgdir/usr/bin/minot"
48
49
install -Dm644 "$srcdir/minot-dev-ext/usr/lib/librat.so" "$pkgdir/usr/lib/librat.so"
50
install -Dm644 "$srcdir/minot-dev-ext/usr/lib/librat.a" "$pkgdir/usr/lib/librat.a"
51
install -Dm644 "$srcdir/minot-dev-ext/usr/include/rat/rat.h" "$pkgdir/usr/include/rat/rat.h"
52
install -Dm644 "$srcdir/minot-dev-ext/usr/lib/pkgconfig/librat.pc" "$pkgdir/usr/lib/pkgconfig/librat.pc"
53
install -Dm644 "$srcdir/minot-dev-ext/usr/lib/cmake/minot/libratConfig.cmake" "$pkgdir/usr/lib/cmake/minot/libratConfig.cmake"
54
55
install -Dm644 "$srcdir/completions/bash" "$pkgdir/usr/share/bash-completion/completions/minot"
56
install -Dm644 "$srcdir/completions/_zsh" "$pkgdir/usr/share/zsh/site-functions/_minot"
57
install -Dm644 "$srcdir/completions/fish" "$pkgdir/usr/share/fish/vendor_completions.d/minot.fish"
58
}
59
Changes since previous scan
--- PKGBUILD @ 2026-10-05 23:40+++ PKGBUILD @ 2026-10-07 00:21@@ -1,6 +1,6 @@ # Maintainer: stelzo <stelzo@steado.de> pkgname=minot-bin-pkgver=0.13.0+pkgver=0.12.0 pkgrel=6 pkgdesc="A versatile toolset for debugging and verifying stateful robot perception software." arch=('x86_64' 'aarch64')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-07 00:21:34 | Medium | 2 |
| 2026-10-06 00:13:36 | Medium | 2 |
| 2026-10-05 23:40:58 | Medium | 1 |
| 2026-10-05 00:08:03 | Medium | 2 |
| 2026-10-04 00:18:08 | Medium | 2 |
| 2026-10-03 00:23:04 | Medium | 2 |
| 2026-10-02 00:00:32 | Medium | 2 |
| 2026-10-01 00:02:06 | Medium | 2 |
| 2026-09-30 00:20:07 | Medium | 2 |
| 2026-09-29 11:23:48 | Medium | 2 |
| 2026-09-29 00:07:46 | Medium | 2 |
| 2026-09-28 00:28:32 | Medium | 2 |
| 2026-09-27 00:07:07 | Medium | 2 |
| 2026-09-26 00:12:15 | Medium | 2 |
| 2026-09-25 00:03:36 | Medium | 2 |
| 2026-09-24 00:24:14 | Medium | 2 |
| 2026-09-23 11:40:33 | Medium | 2 |
| 2026-09-23 00:28:13 | Medium | 2 |
| 2026-09-22 00:15:14 | Medium | 2 |
| 2026-09-21 00:26:32 | Medium | 2 |