mumps-bin

MEDIUM

maintainer pineappletoad 0 votes scanned 2026-09-03 13:53:13.144096

View on AUR

Why flagged

The package installs a prebuilt binary from a personal GitHub release without upstream source build, creating a supply-chain risk if the release artifact is compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a personal GitHub release without upstream source build, creating a supply-chain risk if the release artifact is compromised.

PKGBUILD

      1# Maintainer: pineappletoad
    
      2
    
      3pkgname=mumps-bin
    
      4pkgver=5.9.1
    
      5_pkgrel_src=1
    
      6pkgrel=1
    
      7pkgdesc="Sparse solver library using Gaussian elimination (precompiled)"
    
      8arch=('x86_64')
    
      9url="https://mumps-solver.org"
    
      10license=('custom')
    
      11options=('!debug')
    
      12provides=('mumps')
    
      13conflicts=('mumps' 'mumps-par' 'mumps4')
    
      14depends=('lapack' 'openmpi' 'scotch' 'scalapack' 'metis' 'zlib' 'bzip2')
    
      15
    
      16source=("https://github.com/tubbywrestler/mumps-bin/releases/download/${pkgver}-${_pkgrel_src}/mumps-${pkgver}-${_pkgrel_src}-x86_64.pkg.tar.zst")
    
      17sha256sums=('487d8667f8b9d6a88041b750d921acca05861bfc9912d1b7b579ec3d4e04fe83')
    
      18
    
      19package() {
    
      20    bsdtar -xf "${srcdir}/mumps-${pkgver}-${_pkgrel_src}-x86_64.pkg.tar.zst" -C "${pkgdir}" --exclude .PKGINFO --exclude .BUILDINFO --exclude .MTREE
    
      21}
    
      22

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-03 13:53:13	Medium	2