paintdotjs-bin

MEDIUM

maintainer labystudio 1 votes scanned 2026-10-07 06:05:09.924014

View on AUR

Why flagged

The package bundles a prebuilt Windows portable app (paint.net.5.1.12.portable.x64.zip) from an unofficial third-party release, which is unverifiable and could pose a supply-chain risk if the source were tampered with.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The package bundles a prebuilt Windows portable app (paint.net.5.1.12.portable.x64.zip) from an unofficial third-party release, which is unverifiable and could pose a supply-chain risk if the source were tampered with.

PKGBUILD

      1pkgname=paintdotjs-bin
    
      2pkgver=2.1.2
    
      3pkgrel=1
    
      4pkgdesc='A desktop port of Paint.NET for Linux and macOS'
    
      5arch=('x86_64')
    
      6url='https://paintjs.net/'
    
      7license=('MIT')
    
      8depends=('fuse2' 'gtk3' 'nss')
    
      9makedepends=('nodejs')
    
      10provides=('paintdotjs')
    
      11conflicts=('paintdotjs')
    
      12options=('!strip')
    
      13source=(
    
      14  "paintdotjs-${pkgver}-source.tar.gz::https://github.com/LabyStudio/paintdotjs/archive/refs/tags/v${pkgver}.tar.gz"
    
      15  "paintdotnet.zip::https://github.com/paintdotnet/release/releases/download/v5.1.12/paint.net.5.1.12.portable.x64.zip"
    
      16)
    
      17source_x86_64=("paintdotjs-${pkgver}.AppImage::https://github.com/LabyStudio/paintdotjs/releases/download/v${pkgver}/paintdotjs-${pkgver}-linux-x86_64.AppImage")
    
      18noextract=('paintdotnet.zip' "paintdotjs-${pkgver}.AppImage")
    
      19sha256sums=('66891d1574215dd6e51e65fd76b1c5f495ea1502655364f48a34d3a4037ba7f6' 'd5ae7043f2fb9d365b48dfe243a2aca1c74924de99b04b6445916c95354aefa3')
    
      20sha256sums_x86_64=('5ce8084848fe0c7201252945ac2420e1ab0aca448178f738ab170af7d6d68317')
    
      21
    
      22prepare() {
    
      23  mkdir -p paintdotnet-source
    
      24  bsdtar -xf paintdotnet.zip -C paintdotnet-source
    
      25}
    
      26
    
      27package() {
    
      28  local project="paintdotjs-${pkgver}"
    
      29  install -Dm755 "paintdotjs-${pkgver}.AppImage" "$pkgdir/opt/paintdotjs/paintdotjs.AppImage"
    
      30  node "$project/scripts/install_desktop_assets.js" \
    
      31    --source paintdotnet-source \
    
      32    --output "$pkgdir/opt/paintdotjs/assets" \
    
      33    --manifest "$project/desktop-resources/asset-manifest.json"
    
      34
    
      35  install -Dm755 "$project/aur/paintdotjs" "$pkgdir/usr/bin/paintdotjs"
    
      36  install -Dm644 "$project/aur/paintdotjs.desktop" "$pkgdir/usr/share/applications/paintdotjs.desktop"
    
      37  install -Dm644 "$project/aur/x-paintdotnet.xml" "$pkgdir/usr/share/mime/packages/x-paintdotnet.xml"
    
      38  install -Dm644 "$project/desktop-resources/icon.png" "$pkgdir/usr/share/icons/hicolor/512x512/apps/paintdotjs.png"
    
      39  install -Dm644 "$project/desktop-resources/file-icon.png" "$pkgdir/usr/share/icons/hicolor/512x512/mimetypes/application-x-paintdotnet.png"
    
      40  install -Dm644 "$project/LICENSE.md" "$pkgdir/usr/share/licenses/$pkgname/LICENSE.md"
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-07 06:05:09	Medium	2