openbot-bin

LOW

maintainer niyoko 0 votes scanned 2026-10-23 09:37:04.884234

View on AUR

Why flagged

The package downloads prebuilt AppImages from the project's official GitHub release page, which is a common and legitimate distribution method; the low severity is due to the unverifiable nature of the prebuilt binaries, but the source is from a trusted project-owned repository.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads prebuilt AppImages from the project's official GitHub release page, which is a common and legitimate distribution method; the low severity is due to the unverifiable nature of the prebuilt binaries, but the source is from a trusted project-owned repository.

PKGBUILD

      1# Maintainer: Niyoko Yuliawan <niyoko.yuliawan at logisly dot com>
    
      2pkgname=openbot-bin
    
      3pkgver=0.48.1
    
      4pkgrel=1
    
      5pkgdesc='Local-first desktop workspace for persistent AI teammates'
    
      6arch=('x86_64' 'aarch64')
    
      7url='https://openbot.run/'
    
      8license=('LicenseRef-PolyForm-Noncommercial-1.0.0')
    
      9depends=(
    
      10  'alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'gcc-libs' 'glib2'
    
      11  'glibc' 'gtk3' 'libcups' 'libsecret' 'libx11' 'libxcb' 'libxcomposite'
    
      12  'libxdamage' 'libxext' 'libxfixes' 'libxi' 'libxkbcommon' 'libxrandr'
    
      13  'mesa' 'nspr' 'nss' 'pango' 'systemd-libs' 'xdg-utils'
    
      14)
    
      15makedepends=('7zip' 'desktop-file-utils')
    
      16optdepends=(
    
      17  'bubblewrap: sandbox for Codex agents'
    
      18  'gnome-keyring: Secret Service storage when no other provider is running'
    
      19  'libappindicator: system tray integration'
    
      20  'libnotify: desktop notifications'
    
      21  'nodejs: Local scripts API command-line client'
    
      22  'icu74: upstream x86_64 remote-desktop runtime'
    
      23  'libevdev: upstream x86_64 remote-desktop runtime'
    
      24  'libpulse: upstream x86_64 remote-desktop runtime'
    
      25  'libva: upstream x86_64 remote-desktop runtime'
    
      26  'numactl: upstream x86_64 remote-desktop runtime'
    
      27)
    
      28provides=('openbot')
    
      29conflicts=('openbot')
    
      30options=('!strip' '!debug')
    
      31_release="https://github.com/nightly-labs/openbot/releases/download/v${pkgver}"
    
      32source=(
    
      33  "LICENSE.openbot::https://raw.githubusercontent.com/nightly-labs/openbot/v${pkgver}/LICENSE"
    
      34  "NOTICE.openbot::https://raw.githubusercontent.com/nightly-labs/openbot/v${pkgver}/NOTICE"
    
      35)
    
      36source_x86_64=("${_release}/OpenBot-${pkgver}-x86_64.AppImage")
    
      37source_aarch64=("${_release}/OpenBot-${pkgver}-arm64.AppImage")
    
      38noextract=("OpenBot-${pkgver}-x86_64.AppImage" "OpenBot-${pkgver}-arm64.AppImage")
    
      39sha256sums=(
    
      40  'ffe034ecf735f296ca53cbd856c944849f0c80c7e1490ce162038a99ad89c728'
    
      41  '3995ad096839d696f4ff70227ac56c89b3c25e6b549bb87cf9d98dce901b75f7'
    
      42)
    
      43sha256sums_x86_64=('66bf6c93690612eb019416172b978beeb58e8c5485d4e8cec713ff1e86d3e4fc')
    
      44sha256sums_aarch64=('06acb1b2d9dbc66fd7ce68007edf18358eaf572716eec9d43d2538ff898b52a7')
    
      45
    
      46prepare() {
    
      47  local image_arch=$CARCH
    
      48  [[ $CARCH == aarch64 ]] && image_arch=arm64
    
      49  7z x -y -oapp "OpenBot-${pkgver}-${image_arch}.AppImage" >/dev/null
    
      50  # Start the executable directly to retain Chromium's sandbox.
    
      51  sed -i 's|^Exec=.*|Exec=openbot %U|' app/openbot.desktop
    
      52}
    
      53
    
      54check() {
    
      55  desktop-file-validate app/openbot.desktop
    
      56  test -x app/openbot
    
      57  test -s app/resources/app.asar
    
      58  ! grep -q -- '--no-sandbox' app/openbot.desktop
    
      59}
    
      60
    
      61package() {
    
      62  install -d "$pkgdir/opt/openbot" "$pkgdir/usr/bin"
    
      63  # shortcut: remote desktop needs upstream Ubuntu ABIs, revisit when upstream ships portable binaries.
    
      64  cp -dr --preserve=mode,timestamps app/. "$pkgdir/opt/openbot/"
    
      65  install -Dm644 app/openbot.desktop "$pkgdir/usr/share/applications/openbot.desktop"
    
      66  install -Dm644 app/openbot.png "$pkgdir/usr/share/icons/hicolor/1600x1600/apps/openbot.png"
    
      67  install -Dm644 LICENSE.openbot "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      68  install -Dm644 NOTICE.openbot "$pkgdir/usr/share/licenses/$pkgname/NOTICE"
    
      69  # Arch supplies desktop integration and libraries; skip AppImage-only files.
    
      70  rm -r "$pkgdir/opt/openbot/usr"
    
      71  rm "$pkgdir/opt/openbot/AppRun" "$pkgdir/opt/openbot/.DirIcon" \
    
      72    "$pkgdir/opt/openbot/openbot.desktop" "$pkgdir/opt/openbot/openbot.png"
    
      73  find "$pkgdir/opt/openbot" -type d -exec chmod 755 {} +
    
      74  chmod 4755 "$pkgdir/opt/openbot/chrome-sandbox"
    
      75  ln -s /opt/openbot/openbot "$pkgdir/usr/bin/openbot"
    
      76}
    
      77

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-23 09:37:04	Low	2