openmouse-bridge-bin

LOW

maintainer Arimil 0 votes scanned 2026-10-31 00:07:41.364992

View on AUR

Why flagged

The package uses prebuilt binaries from GitHub and npmjs, but both sources are official and checksummed; the only risk is from the prebuilt nature of the binaries, not from malicious or unverifiable sources.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package uses prebuilt binaries from GitHub and npmjs, but both sources are official and checksummed; the only risk is from the prebuilt nature of the binaries, not from malicious or unverifiable sources.

PKGBUILD

      1# Maintainer: Arimil <renari at arimil dot com>
    
      2
    
      3pkgname=openmouse-bridge-bin
    
      4_pkgname=openmouse-bridge
    
      5# scripts/update.sh keeps _tag, _asset, _nodehid, pkgver and the sums in sync.
    
      6_tag=v1.0.0-beta.20
    
      7_asset=openmouse-bridge-linux-x64.zip
    
      8# node-hid version bundled in the release; see package().
    
      9_nodehid=3.4.0
    
      10# Bridge's in-app update check is pointed at this release; see prepare().
    
      11# Numeric ID of OpenMouse-Project/OpenMouse-Bridge, which keeps the URL short.
    
      12_repoid=1328502232
    
      13_updateurl="https://api.github.com/repositories/${_repoid}/releases/tags/${_tag}"
    
      14pkgver=1.0.0beta.20
    
      15pkgrel=1
    
      16pkgdesc='Background service for OpenMouse: device communication, app detection and automatic profile switching'
    
      17arch=('x86_64')
    
      18url='https://github.com/OpenMouse-Project/OpenMouse-Bridge'
    
      19license=('MIT' 'OFL-1.1')
    
      20# libayatana-appindicator, libglvnd and libxkbcommon-x11 are dlopen()ed by the tray.
    
      21depends=(
    
      22  'gdk-pixbuf2'
    
      23  'glib2'
    
      24  'glibc'
    
      25  'gtk3'
    
      26  'hicolor-icon-theme'
    
      27  'libayatana-appindicator'
    
      28  'libgcc'
    
      29  'libglvnd'
    
      30  'libstdc++'
    
      31  'libusb'
    
      32  'libxkbcommon-x11'
    
      33  'systemd-libs'
    
      34)
    
      35optdepends=(
    
      36  'alsa-utils: notification chime via aplay'
    
      37  'libpulse: notification chime via paplay'
    
      38)
    
      39provides=("${_pkgname}")
    
      40conflicts=("${_pkgname}")
    
      41# Prebuilt upstream binaries, including a bundled Node.js runtime for the HID helper.
    
      42options=('!strip' '!debug')
    
      43install="${pkgname}.install"
    
      44source=(
    
      45  "${_pkgname}-${pkgver}.zip::${url}/releases/download/${_tag}/${_asset}"
    
      46  "${_pkgname}.desktop"
    
      47  "69-${_pkgname}.rules"
    
      48  "${_pkgname}-modules.conf"
    
      49  "node-hid-${_nodehid}.tgz::https://registry.npmjs.org/node-hid/-/node-hid-${_nodehid}.tgz"
    
      50)
    
      51noextract=("node-hid-${_nodehid}.tgz")
    
      52sha256sums=('acc846c7704fe70420283079e08a91652247030b47e1d702c19181fc4323db18'
    
      53            '9eeb9ed4c885c9d03b1f33f8464554cf37d7bceff4c6f3dee4e1efa3d53bb572'
    
      54            '8dea2989b3589cf05511199f72d64eedff19367c992d5f21c1343b3fd0e1b854'
    
      55            '23916ff2940e03188a34a613e343fc43aaf0067ebb82265ba5d8b46ae2466e82'
    
      56            'a6a4700d773e6f9944cad708642864478cd29a7abd42f83d4a1c7125c562fa80')
    
      57
    
      58prepare() {
    
      59  local bundled
    
      60  bundled="$(sed -n 's/^  "version": "\(.*\)",$/\1/p' "${srcdir}/native-hid/node_modules/node-hid/package.json")"
    
      61  if [[ "${bundled}" != "${_nodehid}" ]]; then
    
      62    printf 'release bundles node-hid %s, PKGBUILD expects %s\n' "${bundled}" "${_nodehid}" >&2
    
      63    return 1
    
      64  fi
    
      65
    
      66  # Bridge's self-updater would download each new upstream release and then
    
      67  # fail to replace pacman-managed files. Point its release check at the
    
      68  # packaged tag instead, so it always reports "Up to date". The new URL is
    
      69  # padded with spaces, which URL parsing trims, to the compiled-in length.
    
      70  local old='https://api.github.com/repos/OpenMouse-Project/OpenMouse-Bridge/releases/latest'
    
      71  local offset
    
      72  offset="$(LC_ALL=C grep -a -b -o -F "${old}" "${srcdir}/${_pkgname}" | cut -d: -f1)"
    
      73  if [[ ! "${offset}" =~ ^[0-9]+$ ]] || (( ${#_updateurl} > ${#old} )); then
    
      74    printf 'cannot patch the update URL: %s must appear exactly once in %s and fit %s\n' \
    
      75      "${old}" "${_pkgname}" "${_updateurl}" >&2
    
      76    return 1
    
      77  fi
    
      78  printf '%-*s' "${#old}" "${_updateurl}" |
    
      79    dd of="${srcdir}/${_pkgname}" bs=1 seek="${offset}" conv=notrunc status=none
    
      80}
    
      81
    
      82package() {
    
      83  install -d "${pkgdir}/usr/lib/${_pkgname}"
    
      84  cp -a --no-preserve=ownership \
    
      85    "${srcdir}/${_pkgname}" \
    
      86    "${srcdir}/native-hid" \
    
      87    "${srcdir}/openmouse-app-icon.png" \
    
      88    "${srcdir}/DM-Sans-OFL.txt" \
    
      89    "${pkgdir}/usr/lib/${_pkgname}/"
    
      90  chmod 755 "${pkgdir}/usr/lib/${_pkgname}/${_pkgname}" \
    
      91    "${pkgdir}/usr/lib/${_pkgname}/native-hid/node/bin/node"
    
      92  # Upstream's release strips node-hid's hidraw prebuild, but node-hid loads
    
      93  # that backend by default on Linux, so restore it from the same npm release.
    
      94  local prebuilds="${pkgdir}/usr/lib/${_pkgname}/native-hid/node_modules/node-hid/prebuilds"
    
      95  if [[ ! -e "${prebuilds}/HID_hidraw-linux-x64" ]]; then
    
      96    bsdtar -xf "${srcdir}/node-hid-${_nodehid}.tgz" -C "${prebuilds}" \
    
      97      --strip-components 2 package/prebuilds/HID_hidraw-linux-x64
    
      98  fi
    
      99  # The executable finds native-hid/ next to /proc/self/exe, so a symlink is enough.
    
      100  install -d "${pkgdir}/usr/bin"
    
      101  ln -s "/usr/lib/${_pkgname}/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      102
    
      103  install -Dm644 "${srcdir}/${_pkgname}.desktop" \
    
      104    "${pkgdir}/usr/share/applications/io.openmouse.bridge.desktop"
    
      105  install -Dm644 "${srcdir}/openmouse-app-icon.png" \
    
      106    "${pkgdir}/usr/share/icons/hicolor/512x512/apps/io.openmouse.bridge.png"
    
      107  install -Dm644 "${srcdir}/69-${_pkgname}.rules" \
    
      108    "${pkgdir}/usr/lib/udev/rules.d/69-${_pkgname}.rules"
    
      109  install -Dm644 "${srcdir}/${_pkgname}-modules.conf" \
    
      110    "${pkgdir}/usr/lib/modules-load.d/${_pkgname}.conf"
    
      111
    
      112  install -Dm644 "${srcdir}/README.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      113  install -Dm644 "${srcdir}/DM-Sans-OFL.txt" "${pkgdir}/usr/share/licenses/${pkgname}/DM-Sans-OFL.txt"
    
      114}
    
      115

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-31 00:07:41	Low	2
2026-10-30 23:57:35	Low	2