numr-desktop-bin

MEDIUM

maintainer nasedkinpv 0 votes scanned 2026-11-03 00:04:01.898975

View on AUR

Why flagged

Installs a prebuilt .deb from GitHub releases without source verification, creating a supply-chain risk if the release asset were swapped.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): Installs a prebuilt .deb from GitHub releases without source verification, creating a supply-chain risk if the release asset were swapped.

PKGBUILD

      1# Maintainer: nasedkinpv <nasedkinpv@users.noreply.github.com>
    
      2pkgname=numr-desktop-bin
    
      3pkgver=0.9.2
    
      4pkgrel=1
    
      5pkgdesc="Desktop app for the numr text calculator: variables, units, currencies, live rates"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/nasedkinpv/numr-desktop"
    
      8license=('MIT')
    
      9depends=('webkit2gtk-4.1' 'gtk3' 'libayatana-appindicator' 'librsvg' 'gcc-libs' 'glibc')
    
      10provides=('numr-desktop')
    
      11conflicts=('numr-desktop' 'numr-desktop-git')
    
      12source=("LICENSE-$pkgver::$url/raw/v$pkgver/LICENSE")
    
      13source_x86_64=("$pkgname-$pkgver-amd64.deb::$url/releases/download/v$pkgver/numr_${pkgver}_amd64.deb")
    
      14source_aarch64=("$pkgname-$pkgver-arm64.deb::$url/releases/download/v$pkgver/numr_${pkgver}_arm64.deb")
    
      15sha256sums=('SKIP')
    
      16sha256sums_x86_64=('555a28dc54fd76971e8eda81ffe2941c4cf6421821becb775121fb85c8b87461')
    
      17sha256sums_aarch64=('c24725b41e8d1a68dd335320b8937cf3d41babe4d8f73b1646492a0c1a8a7144')
    
      18
    
      19package() {
    
      20    # makepkg already unpacked the .deb; data.tar.gz holds the file tree.
    
      21    bsdtar -xf data.tar.gz -C "$pkgdir"
    
      22    find "$pkgdir" -type d -exec chmod 755 {} +
    
      23    install -Dm644 "LICENSE-$pkgver" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      24}
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-03 00:04:01	Medium	2