openxplorer-bin

MEDIUM

maintainer Dominiquini 1 votes scanned 2026-09-27 07:16:53.263382

View on AUR

Why flagged

Installs a prebuilt .deb from GitHub releases, which is an unverifiable binary package from a non-whitelisted host, posing a supply-chain risk if the source were swapped.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): Installs a prebuilt .deb from GitHub releases, which is an unverifiable binary package from a non-whitelisted host, posing a supply-chain risk if the source were swapped.

PKGBUILD

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      2
    
      3_gitauthor=AKolenda
    
      4_gitname=openxplorer
    
      5_appname=OpenXplorer
    
      6pkgname=${_gitname}-bin
    
      7pkgdesc="Windows File Explorer-inspired file manager for Linux"
    
      8
    
      9pkgver=1.1.4
    
      10pkgrel=1
    
      11_gitversion=v${pkgver}
    
      12
    
      13arch=('any')
    
      14
    
      15_ghurl="https://github.com/${_gitauthor}/${_gitname}"
    
      16_ghurlraw="https://raw.githubusercontent.com/${_gitauthor}/${_gitname}/${_gitversion}"
    
      17url=${_ghurl}
    
      18
    
      19license=('AGPL-3.0-only')
    
      20
    
      21provides=('openxplorer' 'winspace')
    
      22conflicts=("${provides[@]}")
    
      23
    
      24depends=('bash' 'python' 'python-gobject' 'gtk3' 'glib2' 'libsecret' 'webkit2gtk-4.1' 'hicolor-icon-theme')
    
      25
    
      26options=('!strip')
    
      27
    
      28source=("${_appname}-${pkgver}.deb::${_ghurl}/releases/download/${_gitversion}/${_gitname}_${pkgver}_all.deb"
    
      29		"README-${pkgver}.md::${_ghurlraw}/README.md"
    
      30		"LICENSE-${pkgver}::${_ghurlraw}/LICENSE")
    
      31sha256sums=('010a9c6bf5b14c78af9c7044dae093781c9eb339d471ea32cbd710a55e087b82'
    
      32            'c1c63cf8963d15614c37f42a8f49b00f9996925fddc11a19bf752284bf653d52'
    
      33            'fa330b7ec7715da6050bb6cd8cc5ec86c61d0671da711fcc79460cf69193d260')
    
      34
    
      35
    
      36package() {
    
      37	cd "${pkgdir}"
    
      38
    
      39	tar -xf ${srcdir}/data.tar.xz
    
      40	install -dm755 ${pkgdir}/usr/share/doc/${pkgname}/
    
      41	mv ${pkgdir}/usr/share/doc/${_gitname}/*.md ${pkgdir}/usr/share/doc/${pkgname}/ && rm -rf ${pkgdir}/usr/share/doc/${_gitname}/
    
      42
    
      43	install -Dm644 ${srcdir}/README-${pkgver}.md ${pkgdir}/usr/share/doc/${pkgname}/README.md
    
      44
    
      45	install -Dm644 ${srcdir}/LICENSE-${pkgver} ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
    
      46}
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-27 07:16:53	Medium	2