nanino-news-bin

MEDIUM

maintainer kadrian 0 votes scanned 2026-09-26 21:17:12.114889

View on AUR

Why flagged

A prebuilt proprietary binary downloaded from the maintainer's personal website (kairollmann.de) with no upstream verification beyond a single SHA256 checksum; the host is entirely controlled by the maintainer and could silently swap the binary, making this an unverifiable executable from a personal server rather than official project release infrastructure.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://kairollmann.de/naninonews/releases/1.1.1/Nanino-News_1.1.1_amd64.tar.gz")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): A prebuilt proprietary binary downloaded from the maintainer's personal website (kairollmann.de) with no upstream verification beyond a single SHA256 checksum; the host is entirely controlled by the maintainer and could silently swap the binary, making this an unverifiable executable from a personal server rather than official project release infrastructure.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kai Rollmann <naninonews@kairollmann.de>
    
      2pkgname=nanino-news-bin
    
      3pkgver=1.1.1
    
      4pkgrel=1
    
      5pkgdesc="Your local AI news dashboard: headlines from feeds you choose, in columns, with small AI classifiers that badge, hide or rank them"
    
      6arch=('x86_64')
    
      7url="https://kairollmann.de/naninonews"
    
      8license=('LicenseRef-Proprietary')
    
      9depends=('webkit2gtk-4.1' 'gtk3' 'openssl' 'hicolor-icon-theme')
    
      10provides=('nanino-news')
    
      11conflicts=('nanino-news')
    
      12options=('!strip')
    
      13source=("https://kairollmann.de/naninonews/releases/1.1.1/Nanino-News_1.1.1_amd64.tar.gz")
    
      14sha256sums=('fb5aac87754f1c7d35d680a6fe664661124c4f0dbd60700c83060e3d1416aa1e')
    
      15
    
      16package() {
    
      17  cp -a "${srcdir}/usr" "${pkgdir}/"
    
      18}
    
      19

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-26 21:17:12	Medium	3
2026-09-26 21:15:27	Medium	3