ornithe-installer-bin

MEDIUM

maintainer calvchn 0 votes scanned 2026-09-24 09:45:42.510514

View on AUR

Why flagged

Installs a prebuilt binary from maven.ornithemc.net, which is the project's own Maven repository for OrnitheMC; checksums are provided and non-SKIP, making silent swapping detectable, but it is still an unverified prebuilt executable from a non-whitelisted host with few votes and a recent upload, warranting medium caution.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source_x86_64=("ornithe-installer-rs-linux-x86_64-${pkgver}::https://maven.ornithemc.net/releases/net/ornithemc/ornithe-installer-rs/ornithe-installer-rs-linux-x86_64/${pkgver}/ornithe-installer-rs-linux-x86_64-${pkgver}")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs a prebuilt binary from maven.ornithemc.net, which is the project's own Maven repository for OrnitheMC; checksums are provided and non-SKIP, making silent swapping detectable, but it is still an unverified prebuilt executable from a non-whitelisted host with few votes and a recent upload, warranting medium caution.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: calvchn <calvinforyou at proton dot me>
    
      2
    
      3pkgname=ornithe-installer-bin
    
      4pkgver=0.5.4
    
      5pkgrel=1
    
      6pkgdesc='Installer for ornithe, written in rust'
    
      7arch=('x86_64' 'aarch64')
    
      8url='https://github.com/OrnitheMC/ornithe-installer-rs'
    
      9license=('Apache-2.0')
    
      10options=('!strip')
    
      11
    
      12source_x86_64=("ornithe-installer-rs-linux-x86_64-${pkgver}::https://maven.ornithemc.net/releases/net/ornithemc/ornithe-installer-rs/ornithe-installer-rs-linux-x86_64/${pkgver}/ornithe-installer-rs-linux-x86_64-${pkgver}")
    
      13source_aarch64=("ornithe-installer-rs-linux-aarch64-${pkgver}::https://maven.ornithemc.net/releases/net/ornithemc/ornithe-installer-rs/ornithe-installer-rs-linux-aarch64/${pkgver}/ornithe-installer-rs-linux-aarch64-${pkgver}")
    
      14
    
      15sha256sums_x86_64=('057c21b8b83ac94601c12b9108046dbefaa7dbea303e54fa44c6674770046257')
    
      16sha256sums_aarch64=('9fc32c4bc10cf11be9a238f7f4761e8726d936cd1595a13903fc49c2ffab3d81')
    
      17
    
      18package() {
    
      19    install -Dm755 "${srcdir}/ornithe-installer-rs-linux-${CARCH}-${pkgver}" "${pkgdir}/usr/bin/ornithe-installer"
    
      20}
    
      21

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-24 09:45:42	Medium	3
2026-09-24 09:42:26	Medium	2