pacmang

MEDIUM

maintainer dexield 0 votes scanned 2026-10-18 09:21:55.083363

View on AUR

Why flagged

The package installs a prebuilt executable from a GitHub release with a skipped checksum for the LICENSE file, but the main binary has a valid hash; the source is from the project's own repository, reducing risk, though unverifiable files slightly increase supply-chain concerns.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The package installs a prebuilt executable from a GitHub release with a skipped checksum for the LICENSE file, but the main binary has a valid hash; the source is from the project's own repository, reducing risk, though unverifiable files slightly increase supply-chain concerns.

PKGBUILD

      1# Maintainer: dexield
    
      2pkgname=pacmang
    
      3pkgver=1.2.0
    
      4pkgrel=1
    
      5pkgdesc="Современный графический менеджер пакетов для Arch Linux"
    
      6arch=('x86_64')
    
      7url="https://github.com/dexield/pacmang"
    
      8license=('custom:copyright')
    
      9depends=('gtk4' 'libadwaita' 'json-glib')
    
      10provides=('pacmang')
    
      11conflicts=('pacmang')
    
      12options=(!debug !strip)
    
      13source=('https://github.com/dexield/pacmang/releases/download/v1.2.0/pacmang'
    
      14        'LICENSE')
    
      15sha256sums=('2fc456b05521baa5f3a17db64034f54bfee5a38e0e9fb8237d16212ed1a7dfca'
    
      16            'SKIP')
    
      17
    
      18package() {
    
      19    install -d "$pkgdir/usr/bin"
    
      20    install -Dm755 "$srcdir/pacmang" "$pkgdir/usr/bin/pacmang"
    
      21    install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      22}
    
      23
    
      24

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-18 09:21:55	Medium	2