paclens-bin

LOW

maintainer satyxsing 0 votes scanned 2026-08-26 17:30:31.857880

View on AUR

Why flagged

The package installs a prebuilt binary from the project's official GitHub releases, which is verifiable via matching checksum; the low severity reflects the inherent risk of binary packages but is mitigated by source transparency and proper checksum validation.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from the project's official GitHub releases, which is verifiable via matching checksum; the low severity reflects the inherent risk of binary packages but is mitigated by source transparency and proper checksum validation.

PKGBUILD

      1# Maintainer: plasmaDestroyer <satyasheel2004@gmail.com>
    
      2pkgname=paclens-bin
    
      3_pkgname=paclens
    
      4pkgver=0.3.3
    
      5pkgrel=1
    
      6pkgdesc="A TUI-first pacman + AUR + Flatpak inspection and update tool for Arch Linux (prebuilt binary)"
    
      7arch=('x86_64')
    
      8url="https://github.com/plasmaDestroyer/paclens"
    
      9license=('MIT')
    
      10# Same runtime dependencies as the source package — a prebuilt binary changes
    
      11# how it was compiled, not what it needs. pacman-contrib is not optional:
    
      12# checkupdates is what makes update counts accurate rather than a reading of a
    
      13# possibly-stale local sync db, and paccache is what makes the reclaimable
    
      14# cache figure honest (design §3).
    
      15depends=('gcc-libs' 'glibc' 'pacman' 'pacman-contrib')
    
      16# No makedepends at all. Not needing a 292 MiB Rust toolchain to install a
    
      17# 1 MiB program is the entire reason this package exists.
    
      18provides=("$_pkgname=$pkgver")
    
      19conflicts=("$_pkgname")
    
      20optdepends=(
    
      21  'flatpak: Flatpak app and runtime scanning'
    
      22  'paru: AUR update detection and updates (preferred)'
    
      23  'yay: AUR update detection and updates'
    
      24  'pikaur: AUR update detection and updates'
    
      25)
    
      26source=("$_pkgname-$pkgver.tar.gz::$url/releases/download/v$pkgver/paclens-x86_64-unknown-linux-gnu.tar.gz")
    
      27# Deliberately not 'SKIP'. A binary package is one someone installs without
    
      28# reading what they are installing, so the one thing it must do is verify that
    
      29# what arrived is what was published. Refresh with `updpkgsums` on every
    
      30# version bump; it must match the sha256sums.txt attached to that release.
    
      31sha256sums=('dbb9e7efb0eeaabc3e5a4aa5e2a6dbcd9ad6036717db36d32b3d5aee2141ec41')
    
      32
    
      33package() {
    
      34  install -Dm755 "$srcdir/paclens" "$pkgdir/usr/bin/$_pkgname"
    
      35  install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$_pkgname/LICENSE"
    
      36  install -Dm644 "$srcdir/README.md" "$pkgdir/usr/share/doc/$_pkgname/README.md"
    
      37  install -Dm644 "$srcdir/config.default.toml" \
    
      38    "$pkgdir/usr/share/doc/$_pkgname/config.default.toml"
    
      39}
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-26 17:30:31	Low	2