nuviodesktop-bin
MEDIUM
maintainer khooly
0 votes
scanned 2026-10-06 00:13:36.889724
Why flagged
The package installs a prebuilt .deb from a GitHub release without source verification, creating a supply-chain risk if the release asset were silently swapped.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Medium
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt .deb from a GitHub release without source verification, creating a supply-chain risk if the release asset were silently swapped.
PKGBUILD
1
pkgname=nuviodesktop-bin
2
_tag=0.1.27-alpha
3
pkgver=0.1.27.alpha
4
pkgrel=1
5
pkgdesc='Desktop media app for browsing, organizing and playing media from sources you add'
6
arch=('x86_64')
7
url='https://github.com/NuvioMedia/NuvioDesktop'
8
license=('GPL-3.0-or-later')
9
depends=('alsa-lib' 'fontconfig' 'freetype2' 'glib-networking' 'gst-libav'
10
'gst-plugins-good' 'libx11' 'libxcomposite' 'libxext' 'libxi'
11
'libxrender' 'libxtst' 'mpv' 'webkit2gtk-4.1' 'xdg-utils' 'zlib')
12
provides=('nuvio')
13
conflicts=('nuvio' 'nuvio-desktop' 'nuvio-desktop-bin' 'nuvio-linux-bin')
14
options=('!strip')
15
source=("nuviodesktop-${_tag}.deb::${url}/releases/download/${_tag}/Nuvio-Linux-x86_64-${_tag}.deb")
16
sha256sums=('894ed618a8d5e3397e79ac0fb7fac33678e66f439f161031ffee747379f76aba')
17
18
package() {
19
bsdtar -xf data.tar.zst -C "$pkgdir"
20
install -d "$pkgdir/usr/bin"
21
ln -s /opt/nuvio/bin/Nuvio "$pkgdir/usr/bin/nuvio"
22
install -Dm644 "$pkgdir/opt/nuvio/share/doc/copyright" "$pkgdir/usr/share/licenses/$pkgname/copyright"
23
}
24
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-06 00:13:36 | Medium | 2 |
| 2026-10-05 23:40:58 | Low | 1 |