mozkey-ibg-bin

maintainer kazormia296 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt binary from a GitHub release hosted on a personal account, which is unverifiable and could be silently swapped, posing a supply-chain risk despite plausible project association.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt binary from a GitHub release hosted on a personal account, which is unverifiable and could be silently swapped, posing a supply-chain risk despite plausible project association.

PKGBUILD

      1# Maintainer: kazormia296 <kazormia296@users.noreply.github.com>
    
      2
    
      3pkgname=mozkey-ibg-bin
    
      4pkgver=0.10.1
    
      5pkgrel=1
    
      6pkgdesc='Mozkey IbG Japanese input method for Fcitx 5 (prebuilt)'
    
      7arch=('x86_64')
    
      8url='https://github.com/kazormia296/mozkey-ibg'
    
      9license=('Apache-2.0' 'BSD-3-Clause' 'LGPL-2.1-or-later' 'MIT')
    
      10depends=('fcitx5' 'hicolor-icon-theme' 'llama-cpp' 'qt6-base')
    
      11provides=("mozkey-ibg=${pkgver}")
    
      12conflicts=('mozkey-ibg')
    
      13options=('!debug' '!strip')
    
      14source_x86_64=(
    
      15  "${pkgname}-${pkgver}-${CARCH}.tar.xz::${url}/releases/download/v${pkgver}/mozkey-ibg-v${pkgver}-archlinux-${CARCH}.tar.xz"
    
      16)
    
      17sha256sums_x86_64=('31e6133c6c8cf833a989061b22ca0571a27a35e034cfb3236723848b001dd6d0')
    
      18
    
      19package() {
    
      20  cp -a --no-preserve=ownership "${srcdir}/usr" "${pkgdir}/"
    
      21  install -Dm644 "${srcdir}/usr/share/licenses/mozkey-ibg/Mozc-LICENSE.txt" \
    
      22    "${pkgdir}/usr/share/licenses/${pkgname}/BSD-3-Clause.txt"
    
      23  install -Dm644 \
    
      24    "${srcdir}/usr/share/licenses/mozkey-ibg/zenz-runtime/llama.cpp-MIT.txt" \
    
      25    "${pkgdir}/usr/share/licenses/${pkgname}/MIT.txt"
    
      26}
    
      27

Changes since previous scan

--- PKGBUILD @ 2026-07-22 11:20
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: kazormia296 <kazormia296@users.noreply.github.com>
 
 pkgname=mozkey-ibg-bin
-pkgver=0.10.0
+pkgver=0.10.1
 pkgrel=1
 pkgdesc='Mozkey IbG Japanese input method for Fcitx 5 (prebuilt)'
 arch=('x86_64')
@@ -14,7 +14,7 @@
 source_x86_64=(
   "${pkgname}-${pkgver}-${CARCH}.tar.xz::${url}/releases/download/v${pkgver}/mozkey-ibg-v${pkgver}-archlinux-${CARCH}.tar.xz"
 )
-sha256sums_x86_64=('807c7e65bf2e304ae5e662d9f0fa6049e68d2eaeed8609413c1b4ab7e7b1abab')
+sha256sums_x86_64=('31e6133c6c8cf833a989061b22ca0571a27a35e034cfb3236723848b001dd6d0')
 
 package() {
   cp -a --no-preserve=ownership "${srcdir}/usr" "${pkgdir}/"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 21:22:00	MEDIUM	2
2026-07-22 11:20:06	LOW	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 05:16:02	MEDIUM	2