nuvio-linux-bin

maintainer dizziee · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package installs a prebuilt binary from a GitHub release, which is a common and generally safe practice for AUR binary packages; the source is verifiable via PGP signature, and the payload consists of standard application files without evidence of malicious intent.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from a GitHub release, which is a common and generally safe practice for AUR binary packages; the source is verifiable via PGP signature, and the payload consists of standard application files without evidence of malicious intent.

PKGBUILD

      1# Maintainer: dizziee <jjdizz1l@gmail.com>
    
      2#
    
      3# Nuvio Linux — Linux-native mpv desktop media player (AUR binary package).
    
      4#
    
      5# Installs the prebuilt Arch package attached to the GitHub release — no
    
      6# compilation. Pair with `nuvio-linux-git` (source) and the release-pinned
    
      7# stable package.
    
      8#
    
      9# Bump on every release: update pkgver/pkgrel, the source URL, and the sha256
    
      10# (grab it from the release's SHA256SUMS.txt).
    
      11
    
      12pkgname=nuvio-linux-bin
    
      13pkgver=0.1.17alpha
    
      14pkgrel=6
    
      15pkgdesc="Nuvio Linux desktop media player — Linux native mpv playback (binary)"
    
      16arch=('x86_64')
    
      17url="https://github.com/JJDizz1L/NuvioLinux"
    
      18license=('custom:commercial')
    
      19depends=('mpv' 'glibc' 'gcc-libs' 'libstdc++' 'libx11' 'libxext' 'libxrender' 'libxi' 'libxtst')
    
      20install=nuvio-linux-bin.install
    
      21provides=('nuvio-linux')
    
      22conflicts=('nuvio-linux' 'nuvio-linux-git')
    
      23source=(
    
      24  "nuvio-linux-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst::https://github.com/JJDizz1L/NuvioLinux/releases/download/v0.1.17-alpha-6/nuvio-linux-0.1.17alpha-6-x86_64.pkg.tar.zst"
    
      25  "nuvio-linux-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst.sig::https://github.com/JJDizz1L/NuvioLinux/releases/download/v0.1.17-alpha-6/nuvio-linux-0.1.17alpha-6-x86_64.pkg.tar.zst.sig"
    
      26)
    
      27sha256sums=(
    
      28  '13b5ad91693b3bd595f0e7c07862d2c9f584e025124fe895d94296a3e56d16b3'
    
      29  'SKIP'
    
      30)
    
      31validpgpkeys=('54B66A801C9B0D3D471E01376702DBAB3E41EDE1')
    
      32
    
      33package() {
    
      34  # Extract only the payload (opt/, usr/); skip the source package's own
    
      35  # metadata dotfiles (.PKGINFO/.BUILDINFO/.MTREE/.INSTALL), which makepkg
    
      36  # rejects as dotfiles in the package root.
    
      37  tar -xf "${srcdir}/nuvio-linux-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst" -C "${pkgdir}" opt usr
    
      38}
    
      39

Changes since previous scan

--- PKGBUILD @ 2026-08-14 07:28
+++ PKGBUILD @ 2026-08-18 00:03
@@ -11,7 +11,7 @@
 
 pkgname=nuvio-linux-bin
 pkgver=0.1.17alpha
-pkgrel=5
+pkgrel=6
 pkgdesc="Nuvio Linux desktop media player — Linux native mpv playback (binary)"
 arch=('x86_64')
 url="https://github.com/JJDizz1L/NuvioLinux"
@@ -21,11 +21,11 @@
 provides=('nuvio-linux')
 conflicts=('nuvio-linux' 'nuvio-linux-git')
 source=(
-  "nuvio-linux-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst::https://github.com/JJDizz1L/NuvioLinux/releases/download/v0.1.17-alpha-5/nuvio-linux-0.1.17alpha-5-x86_64.pkg.tar.zst"
-  "nuvio-linux-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst.sig::https://github.com/JJDizz1L/NuvioLinux/releases/download/v0.1.17-alpha-5/nuvio-linux-0.1.17alpha-5-x86_64.pkg.tar.zst.sig"
+  "nuvio-linux-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst::https://github.com/JJDizz1L/NuvioLinux/releases/download/v0.1.17-alpha-6/nuvio-linux-0.1.17alpha-6-x86_64.pkg.tar.zst"
+  "nuvio-linux-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst.sig::https://github.com/JJDizz1L/NuvioLinux/releases/download/v0.1.17-alpha-6/nuvio-linux-0.1.17alpha-6-x86_64.pkg.tar.zst.sig"
 )
 sha256sums=(
-  'edda9bfe711b3cf737af2c51ba1d8f4e6b02f080c9a794aeff44514b4dffe87b'
+  '13b5ad91693b3bd595f0e7c07862d2c9f584e025124fe895d94296a3e56d16b3'
   'SKIP'
 )
 validpgpkeys=('54B66A801C9B0D3D471E01376702DBAB3E41EDE1')

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 21:29:33	LOW	2
2026-08-14 07:28:04	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 03:25:23	LOW	2