minot-bin

MEDIUM
maintainer stelzo 0 votes scanned 2026-08-22 19:18:20.646816
View on AUR
Why flagged

The package downloads prebuilt .deb binaries from a non-standard, unverifiable host (codeberg.page subdomain) with SKIP'd checksums, creating a supply-chain risk if the host is compromised or the binaries are swapped.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:13 "$pkgname-$pkgver-bin.deb::https://uos-robotics.codeberg.page/ppa/ubuntu/pool/main/noble/minot_$pkgver-1_amd64.deb"
Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt .deb binaries from a non-standard, unverifiable host (codeberg.page subdomain) with SKIP'd checksums, creating a supply-chain risk if the host is compromised or the binaries are swapped.

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Christopher Sieh (stelzo) <stelzo@steado.de>
2pkgname=minot-bin
3pkgver=0.9.0
4pkgrel=6
5pkgdesc="A versatile toolset for debugging and verifying stateful robot perception software."
6arch=('x86_64' 'aarch64')
7url="https://codeberg.org/stelzo/minot"
8license=('MIT' 'Apache-2.0')
9depends=('libgcc' 'glibc')
10makedepends=()
11options=('!lto' '!strip' '!debug')
12source_x86_64=(
13 "$pkgname-$pkgver-bin.deb::https://uos-robotics.codeberg.page/ppa/ubuntu/pool/main/noble/minot_$pkgver-1_amd64.deb"
14 "$pkgname-$pkgver-dev.deb::https://uos-robotics.codeberg.page/ppa/ubuntu/pool/main/noble/librat-dev_$pkgver-1_amd64.deb"
15)
16sha256sums_x86_64=('SKIP' 'SKIP')
17source_aarch64=(
18 "$pkgname-$pkgver-bin.deb::https://uos-robotics.codeberg.page/ppa/ubuntu/pool/main/noble/minot_$pkgver-1_arm64.deb"
19 "$pkgname-$pkgver-dev.deb::https://uos-robotics.codeberg.page/ppa/ubuntu/pool/main/noble/librat-dev_$pkgver-1_arm64.deb"
20)
21sha256sums_aarch64=('SKIP' 'SKIP')
22noextract=("$pkgname-$pkgver-bin.deb" "$pkgname-$pkgver-dev.deb")
23provides=('minot' 'librat')
24conflicts=('minot' 'librat')
25
26prepare() {
27 mkdir -p "$srcdir/minot-bin-ext" "$srcdir/minot-dev-ext"
28
29 cd "$srcdir/minot-bin-ext"
30 bsdtar -xf "$srcdir/$pkgname-$pkgver-bin.deb"
31 tar -xpf data.tar.*
32
33 cd "$srcdir/minot-dev-ext"
34 bsdtar -xf "$srcdir/$pkgname-$pkgver-dev.deb"
35 tar -xpf data.tar.*
36}
37
38build() {
39 MINOT_CLI_PATH="$srcdir/minot-bin-ext/usr/bin/minot"
40 mkdir -p "$srcdir/completions"
41 "$MINOT_CLI_PATH" completions bash > "$srcdir/completions/bash"
42 "$MINOT_CLI_PATH" completions zsh > "$srcdir/completions/_zsh"
43 "$MINOT_CLI_PATH" completions fish > "$srcdir/completions/fish"
44}
45
46package() {
47 install -Dm755 "$srcdir/minot-bin-ext/usr/bin/minot" "$pkgdir/usr/bin/minot"
48
49 install -Dm644 "$srcdir/minot-dev-ext/usr/lib/librat.so" "$pkgdir/usr/lib/librat.so"
50 install -Dm644 "$srcdir/minot-dev-ext/usr/lib/librat.a" "$pkgdir/usr/lib/librat.a"
51 install -Dm644 "$srcdir/minot-dev-ext/usr/include/rat/rat.h" "$pkgdir/usr/include/rat/rat.h"
52 install -Dm644 "$srcdir/minot-dev-ext/usr/lib/pkgconfig/librat.pc" "$pkgdir/usr/lib/pkgconfig/librat.pc"
53 install -Dm644 "$srcdir/minot-dev-ext/usr/lib/cmake/minot/libratConfig.cmake" "$pkgdir/usr/lib/cmake/minot/libratConfig.cmake"
54
55 install -Dm644 "$srcdir/completions/bash" "$pkgdir/usr/share/bash-completion/completions/minot"
56 install -Dm644 "$srcdir/completions/_zsh" "$pkgdir/usr/share/zsh/site-functions/_minot"
57 install -Dm644 "$srcdir/completions/fish" "$pkgdir/usr/share/fish/vendor_completions.d/minot.fish"
58}
59

Changes since previous scan

--- PKGBUILD @ 2026-06-27 16:30
+++ PKGBUILD @ 2026-08-22 19:18
@@ -1,48 +1,56 @@
# Maintainer: Christopher Sieh (stelzo) <stelzo@steado.de>
pkgname=minot-bin
-pkgver=0.8.0
-pkgrel=3
+pkgver=0.9.0
+pkgrel=6
pkgdesc="A versatile toolset for debugging and verifying stateful robot perception software."
-arch=('x86_64')
-url="https://github.com/uos/minot"
+arch=('x86_64' 'aarch64')
+url="https://codeberg.org/stelzo/minot"
license=('MIT' 'Apache-2.0')
depends=('libgcc' 'glibc')
-makedepends=('zensical')
+makedepends=()
options=('!lto' '!strip' '!debug')
-source=("$pkgname-$pkgver-bin.tar.gz::$url/releases/download/v$pkgver/minot-$CARCH-unknown-linux-gnu.tar.gz" "$pkgname-$pkgver-src.tar.gz::$url/archive/v$pkgver.tar.gz")
-sha256sums=('SKIP' 'SKIP')
-provides=('minot' 'minot-coord' 'wind-rat' 'librat')
-conflicts=('minot' 'minot-coord' 'wind-rat' 'librat')
+source_x86_64=(
+ "$pkgname-$pkgver-bin.deb::https://uos-robotics.codeberg.page/ppa/ubuntu/pool/main/noble/minot_$pkgver-1_amd64.deb"
+ "$pkgname-$pkgver-dev.deb::https://uos-robotics.codeberg.page/ppa/ubuntu/pool/main/noble/librat-dev_$pkgver-1_amd64.deb"
+)
+sha256sums_x86_64=('SKIP' 'SKIP')
+source_aarch64=(
+ "$pkgname-$pkgver-bin.deb::https://uos-robotics.codeberg.page/ppa/ubuntu/pool/main/noble/minot_$pkgver-1_arm64.deb"
+ "$pkgname-$pkgver-dev.deb::https://uos-robotics.codeberg.page/ppa/ubuntu/pool/main/noble/librat-dev_$pkgver-1_arm64.deb"
+)
+sha256sums_aarch64=('SKIP' 'SKIP')
+noextract=("$pkgname-$pkgver-bin.deb" "$pkgname-$pkgver-dev.deb")
+provides=('minot' 'librat')
+conflicts=('minot' 'librat')
+
+prepare() {
+ mkdir -p "$srcdir/minot-bin-ext" "$srcdir/minot-dev-ext"
+
+ cd "$srcdir/minot-bin-ext"
+ bsdtar -xf "$srcdir/$pkgname-$pkgver-bin.deb"
+ tar -xpf data.tar.*
+
+ cd "$srcdir/minot-dev-ext"
+ bsdtar -xf "$srcdir/$pkgname-$pkgver-dev.deb"
+ tar -xpf data.tar.*
+}
build() {
- cd "$srcdir/minot-$pkgver/docs/" && zensical build --clean && cd -
-
- MINOT_CLI_PATH="$srcdir/minot-$CARCH-unknown-linux-gnu/rat/minot"
+ MINOT_CLI_PATH="$srcdir/minot-bin-ext/usr/bin/minot"
mkdir -p "$srcdir/completions"
"$MINOT_CLI_PATH" completions bash > "$srcdir/completions/bash"
"$MINOT_CLI_PATH" completions zsh > "$srcdir/completions/_zsh"
"$MINOT_CLI_PATH" completions fish > "$srcdir/completions/fish"
}
+package() {
+ install -Dm755 "$srcdir/minot-bin-ext/usr/bin/minot" "$pkgdir/usr/bin/minot"
-package() {
- install -Dm755 "$srcdir/minot-$CARCH-unknown-linux-gnu/rat/minot" "$pkgdir/usr/bin/minot"
- install -Dm755 "$srcdir/minot-$CARCH-unknown-linux-gnu/minot-coord" "$pkgdir/usr/bin/minot-coord"
- install -Dm755 "$srcdir/minot-$CARCH-unknown-linux-gnu/wind-rat" "$pkgdir/usr/bin/wind-rat"
- install -Dm755 "$srcdir/minot-$CARCH-unknown-linux-gnu/librat.so" "$pkgdir/usr/lib/librat.so"
- install -Dm755 "$srcdir/minot-$CARCH-unknown-linux-gnu/librat.a" "$pkgdir/usr/lib/librat.a"
- install -Dm644 "$srcdir/minot-$CARCH-unknown-linux-gnu/rat.h" "$pkgdir/usr/include/rat.h"
- install -Dm644 "$srcdir/minot-$pkgver/mt_rat/librat.pc" "$pkgdir/usr/lib/pkgconfig/librat.pc"
-
- install -Dm644 "$srcdir/minot-$pkgver/LICENSE-MIT" "$pkgdir/usr/share/licenses/minot/LICENSE-MIT"
- install -Dm644 "$srcdir/minot-$pkgver/LICENSE-APACHE" "$pkgdir/usr/share/licenses/minot/LICENSE-APACHE"
-
- install -d "$pkgdir/usr/share/doc/minot"
- cp -a "$srcdir/minot-$pkgver/docs/site/." "$pkgdir/usr/share/doc/minot/"
- find "$pkgdir/usr/share/doc/minot/" -type d -exec chmod 755 {} +
- find "$pkgdir/usr/share/doc/minot/" -type f -exec chmod 644 {} +
-
- install -Dm644 "$srcdir/minot-$pkgver/README.md" "$pkgdir/usr/share/doc/minot/README.md"
+ install -Dm644 "$srcdir/minot-dev-ext/usr/lib/librat.so" "$pkgdir/usr/lib/librat.so"
+ install -Dm644 "$srcdir/minot-dev-ext/usr/lib/librat.a" "$pkgdir/usr/lib/librat.a"
+ install -Dm644 "$srcdir/minot-dev-ext/usr/include/rat/rat.h" "$pkgdir/usr/include/rat/rat.h"
+ install -Dm644 "$srcdir/minot-dev-ext/usr/lib/pkgconfig/librat.pc" "$pkgdir/usr/lib/pkgconfig/librat.pc"
+ install -Dm644 "$srcdir/minot-dev-ext/usr/lib/cmake/minot/libratConfig.cmake" "$pkgdir/usr/lib/cmake/minot/libratConfig.cmake"
install -Dm644 "$srcdir/completions/bash" "$pkgdir/usr/share/bash-completion/completions/minot"
install -Dm644 "$srcdir/completions/_zsh" "$pkgdir/usr/share/zsh/site-functions/_minot"

Scan history

Scanned at (UTC)SeverityRules
2026-08-22 19:18:20 Medium 2
2026-06-27 16:30:12 Clean 0
2026-06-27 10:29:17 Clean 0
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion