openquotacycle-bin

LOW

maintainer oioi555 0 votes scanned 2026-09-17 01:24:19.570146

View on AUR

Why flagged

The package downloads a prebuilt .deb from GitHub Releases, which is a common and generally acceptable practice for AUR binary packages; the source is verifiable and checksummed, and the worst case of a swapped artifact is limited to code execution within the app's scope, but it builds no code from untrusted sources.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt .deb from GitHub Releases, which is a common and generally acceptable practice for AUR binary packages; the source is verifiable and checksummed, and the worst case of a swapped artifact is limited to code execution within the app's scope, but it builds no code from untrusted sources.

PKGBUILD

      1# Maintainer: oioi555 <oioi555x@gmail.com>
    
      2# AUR package: unpacks the GitHub Release .deb.
    
      3# Local source builds use ../PKGBUILD (openquotacycle-git), not this file.
    
      4
    
      5pkgname=openquotacycle-bin
    
      6pkgver=0.2.0
    
      7pkgrel=1
    
      8pkgdesc="Linux desktop app for planning AI coding quotas around the 5-hour window"
    
      9arch=('x86_64')
    
      10url="https://github.com/oioi555/openquotacycle"
    
      11license=('MIT')
    
      12provides=('openquotacycle')
    
      13conflicts=('openquotacycle' 'quotracker' 'quotracker-bin' 'quotracker-git')
    
      14replaces=('quotracker' 'quotracker-bin' 'quotracker-git')
    
      15depends=('webkit2gtk-4.1' 'gtk3')
    
      16options=('!strip' '!debug')
    
      17source=("https://github.com/oioi555/openquotacycle/releases/download/v0.2.0/OpenQuotaCycle_0.2.0_amd64.deb")
    
      18sha256sums=('e2eea016710e496e6d1a0f59d94d4453f912e61adb8f9385028682d9b7419cf7')
    
      19noextract=("${source[0]##*/}")
    
      20
    
      21package() {
    
      22    local data_archive
    
      23    bsdtar -xf "${srcdir}"/*.deb
    
      24    data_archive="$(printf '%s\n' data.tar.* | head -n 1)"
    
      25    if [[ ! -f "${data_archive}" ]]; then
    
      26        echo "data.tar archive not found in .deb" >&2
    
      27        return 1
    
      28    fi
    
      29    bsdtar -xf "${data_archive}" -C "${pkgdir}"
    
      30}
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 01:24:19	Low	2