moonlight-qt-qiin2333-bin

MEDIUM

maintainer QiE2035 0 votes scanned 2026-10-22 03:33:54.949562

View on AUR

Why flagged

The package distributes a prebuilt AppImage from a GitHub release, which is an unverifiable executable binary; while the source is from a plausible project owner, the lack of build-from-source and use of a third-party fork introduces supply-chain risk if the AppImage is compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package distributes a prebuilt AppImage from a GitHub release, which is an unverifiable executable binary; while the source is from a plausible project owner, the lack of build-from-source and use of a third-party fork introduces supply-chain risk if the AppImage is compromised.

PKGBUILD

      1# Maintainer: QiE2035 <qie2035@qq.com>
    
      2
    
      3pkgname=moonlight-qt-qiin2333-bin
    
      4_pkgname=moonlight-qt-qiin2333
    
      5pkgver=6.5.0
    
      6pkgrel=1
    
      7pkgdesc="GameStream client for PCs with extra features (qiin2333 fork, prebuilt AppImage)"
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://github.com/qiin2333/moonlight-qt"
    
      10license=('GPL-3.0-or-later')
    
      11depends=(
    
      12  'e2fsprogs'
    
      13  'fontconfig'
    
      14  'freetype2'
    
      15  'gcc-libs'
    
      16  'glibc'
    
      17  'hicolor-icon-theme'
    
      18  'libdrm'
    
      19  'libglvnd'
    
      20  'libgpg-error'
    
      21  'libva'
    
      22  'libx11'
    
      23  'libxcb'
    
      24  'wayland'
    
      25  'zlib'
    
      26)
    
      27optdepends=(
    
      28  'intel-media-driver: VA-API hardware decoding on Intel Broadwell (2014) and newer'
    
      29  'libva-intel-driver: VA-API hardware decoding on Intel GMA 4500 (2008) up to Coffee Lake'
    
      30  'libva-mesa-driver: VA-API hardware decoding on AMD GPUs'
    
      31)
    
      32provides=('moonlight-qt' "$_pkgname")
    
      33conflicts=('moonlight-qt' "$_pkgname")
    
      34options=('!strip' '!debug' '!emptydirs')
    
      35source=("LICENSE::https://raw.githubusercontent.com/qiin2333/moonlight-qt/v$pkgver/LICENSE")
    
      36sha256sums=('589ed823e9a84c56feb95ac58e7cf384626b9cbf4fda2a907bc36e103de1bad2')
    
      37source_x86_64=("Moonlight-VPlus-$pkgver-x86_64.AppImage::https://github.com/qiin2333/moonlight-qt/releases/download/v$pkgver/Moonlight-VPlus-$pkgver-x86_64.AppImage")
    
      38sha256sums_x86_64=('35e41bef7f23125c25a6f2ee8f283a2f4e54283082fa2b8014348aab311fc3ea')
    
      39source_aarch64=("Moonlight-VPlus-$pkgver-aarch64.AppImage::https://github.com/qiin2333/moonlight-qt/releases/download/v$pkgver/Moonlight-VPlus-$pkgver-aarch64.AppImage")
    
      40sha256sums_aarch64=('33c33341c766118dc351f746ca4e93d35cc49efb10dcf70c1daed13e6333f21b')
    
      41
    
      42prepare() {
    
      43  cd "$srcdir"
    
      44  chmod +x "Moonlight-VPlus-$pkgver-$CARCH.AppImage"
    
      45  rm -rf squashfs-root
    
      46  ./"Moonlight-VPlus-$pkgver-$CARCH.AppImage" --appimage-extract >/dev/null
    
      47  [[ -x squashfs-root/AppRun ]] || { echo 'AppImage extraction failed' >&2; return 1; }
    
      48
    
      49  # Debian copyright/changelog leftovers linuxdeploy pulled in for the bundled libs
    
      50  rm -rf squashfs-root/usr/share/doc
    
      51}
    
      52
    
      53package() {
    
      54  # self-contained bundle: bundled Qt 6, FFmpeg, SDL2, libplacebo plus the
    
      55  # upstream AppRun, which only falls back to the staged libva when the host
    
      56  # one cannot load the installed GPU drivers
    
      57  install -dm755 "$pkgdir/opt/$pkgname"
    
      58  cp --reflink=auto -a squashfs-root/. "$pkgdir/opt/$pkgname/"
    
      59  # the AppImage runtime extracts directories as 0700, which would hide the
    
      60  # whole bundle from every user but root
    
      61  chmod -R a+rX "$pkgdir/opt/$pkgname"
    
      62
    
      63  install -Dm755 /dev/stdin "$pkgdir/usr/bin/moonlight" <<EOF
    
      64#!/bin/sh
    
      65exec /opt/$pkgname/AppRun "\$@"
    
      66EOF
    
      67
    
      68  # drop the AppImage-only key from the upstream desktop entry
    
      69  sed '/^X-AppImage-Version=/d' \
    
      70    squashfs-root/usr/share/applications/com.moonlight_stream.Moonlight.desktop |
    
      71    install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/com.moonlight_stream.Moonlight.desktop"
    
      72
    
      73  install -Dm644 squashfs-root/usr/share/icons/hicolor/scalable/apps/moonlight.svg \
    
      74    "$pkgdir/usr/share/icons/hicolor/scalable/apps/moonlight.svg"
    
      75  install -Dm644 squashfs-root/usr/share/metainfo/com.moonlight_stream.Moonlight.appdata.xml \
    
      76    "$pkgdir/usr/share/metainfo/com.moonlight_stream.Moonlight.appdata.xml"
    
      77
    
      78  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      79}
    
      80

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-22 03:33:54	Medium	2