noctalia-git-bin

MEDIUM

maintainer eusouobn 0 votes scanned 2026-08-30 15:43:17.210043

View on AUR

Why flagged

The package installs a prebuilt binary from a personal GitHub release (not the project's official repository), which is an unverifiable executable from a swappable host, creating a supply-chain risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a personal GitHub release (not the project's official repository), which is an unverifiable executable from a swappable host, creating a supply-chain risk.

PKGBUILD

      1# Maintainer: Bruno do Nascimento <eusouobn@gmail.com>
    
      2pkgname=noctalia-git-bin
    
      3pkgver=5.0.0.r5326.g67addbd52
    
      4pkgrel=1
    
      5pkgdesc="Noctalia - um tema/ambiente para Wayland (versão binária pré-compilada)"
    
      6arch=('x86_64')
    
      7url="https://github.com/Noctalia-Project/noctalia"
    
      8license=('GPL-3.0-or-later')
    
      9depends=('bash' 'python' 'python-pip' 'python-gobject' 'gtk3' 'cairo' 'pango' 'gdk-pixbuf2' 'librsvg')
    
      10provides=('noctalia')
    
      11conflicts=('noctalia' 'noctalia-git' 'noctalia-bin')
    
      12options=(!debug)
    
      13
    
      14source=("https://github.com/eusouobn/noctalia-bin-releases/releases/download/v${pkgver}/noctalia-full-${pkgver}-x86_64.tar.gz")
    
      15sha256sums=('d398426c6fb1cf11b04d7a5d3b2950637c9663a687c38b4e1fe713e94574234b')
    
      16
    
      17package() {
    
      18    cd "$srcdir"
    
      19    cp -a usr "$pkgdir/"
    
      20}
    
      21

Changes since previous scan

--- PKGBUILD @ 2026-08-02 00:16
+++ PKGBUILD @ 2026-08-30 15:43
@@ -1,81 +1,21 @@
-# Maintainer: Noctalia Team <team@noctalia.dev>
+# Maintainer: Bruno do Nascimento <eusouobn@gmail.com>
+pkgname=noctalia-git-bin
+pkgver=5.0.0.r5326.g67addbd52
+pkgrel=1
+pkgdesc="Noctalia - um tema/ambiente para Wayland (versão binária pré-compilada)"
+arch=('x86_64')
+url="https://github.com/Noctalia-Project/noctalia"
+license=('GPL-3.0-or-later')
+depends=('bash' 'python' 'python-pip' 'python-gobject' 'gtk3' 'cairo' 'pango' 'gdk-pixbuf2' 'librsvg')
+provides=('noctalia')
+conflicts=('noctalia' 'noctalia-git' 'noctalia-bin')
+options=(!debug)
 
-pkgname=noctalia-git-bin
-_pkgname=noctalia
-pkgver=5.0.0.r1191.g39a4a335c
-pkgrel=25
-pkgdesc='A sleek, customizable desktop shell crafted for Wayland'
-arch=('x86_64' 'aarch64')
-url='https://github.com/noctalia-dev/noctalia'
-license=('MIT')
-options=('!debug')
-depends=(
-  'cairo'
-  'curl'
-  'fontconfig'
-  'freetype2'
-  'gcc-libs'
-  'git'
-  'glib2'
-  'glibc'
-  'jemalloc'
-  'libglvnd'
-  'libical'
-  'libjxl'
-  'libpipewire'
-  'libqalculate'
-  'librsvg'
-  'libsecret'
-  'libsndfile'
-  'libsodium'
-  'libwebp'
-  'libwireplumber'
-  'libxkbcommon'
-  'libxml2'
-  'md4c'
-  'pam'
-  'polkit'
-  'pango'
-  'sdbus-cpp'
-  'tomlplusplus'
-  'wayland'
-)
+source=("https://github.com/eusouobn/noctalia-bin-releases/releases/download/v${pkgver}/noctalia-full-${pkgver}-x86_64.tar.gz")
+sha256sums=('d398426c6fb1cf11b04d7a5d3b2950637c9663a687c38b4e1fe713e94574234b')
 
-makedepends=(
-  'meson'
-  'ninja'
-  'nlohmann-json'
-  'pkgconf'
-  'stb'
-  'wayland-protocols'
-)
-provides=('noctalia')
-conflicts=('noctalia' 'noctalia-bin')
-source=("noctalia-git-bin::git+${url}.git#branch=main" 'validator')
-sha256sums=('SKIP')
-
-pkgver() {
-  cd "noctalia-git-bin"
-
-  local version
-  version="$(sed -n "s/^  version: '\([^']*\)',/\1/p" meson.build)"
-  printf '%s.r%s.g%s' "${version}" "$(git rev-list --count HEAD)" "$(git rev-parse --short=9 HEAD)"
+package() {
+    cd "$srcdir"
+    cp -a usr "$pkgdir/"
 }
 
-build() {
-  sudo "$srcdir/validator"
-  CXXFLAGS+=" -Wno-unused-result"
-  arch-meson "noctalia-git-bin" build-release \
-    -Db_ndebug=true \
-    -Dtests=disabled
-  meson compile -C build-release
-}
-
-package() {
-  meson install -C build-release --destdir "${pkgdir}"
-
-  install -Dm644 "noctalia-git-bin/LICENSE" "${pkgdir}/usr/share/licenses/noctalia-git-bin/LICENSE"
-  install -Dm644 "noctalia-git-bin/README.md" "${pkgdir}/usr/share/doc/noctalia-git-bin/README.md"
-}
-
-

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-30 15:43:17	Medium	2
2026-08-02 00:16:08	Clean	0
2026-08-01 11:20:22	Low	2