paseo-cli-git-bin

MEDIUM

maintainer xpufx 0 votes scanned 2026-09-07 11:14:32.669265

View on AUR

Why flagged

The package installs a prebuilt binary tarball from a third-party GitHub release (xpufx/xpufx-pkgs) instead of building from source, which introduces a supply-chain risk if the host is compromised or the artifact is swapped.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary tarball from a third-party GitHub release (xpufx/xpufx-pkgs) instead of building from source, which introduces a supply-chain risk if the host is compromised or the artifact is swapped.

PKGBUILD

      1# Maintainer: xpufx <github@xpufx.com>
    
      2# Prebuilt companion to paseo-cli-git: same tree (built from upstream/main),
    
      3# repacked from our release asset so users skip the npm build.
    
      4# _commit pins the upstream commit; _bin_sha pins the prebuilt tarball.
    
      5
    
      6pkgname=paseo-cli-git-bin
    
      7pkgver=0.7.2.r44.gb403dea32
    
      8pkgrel=1
    
      9_commit='b403dea32beaed5e1f9a08db52b88d12579c6dd2'
    
      10_bin_sha='9f4da6067efff9fdb18b2dbdf9937ff82df7d0786ff53ab255fa4ca33589a3d4'
    
      11_pkgdesc_base='Command-line interface for controlling Paseo AI coding agents'
    
      12pkgdesc='Command-line interface for controlling Paseo AI coding agents (git-bin - prebuilt from main 2026-09-06 @b403dea)'
    
      13arch=('x86_64')
    
      14url='https://github.com/getpaseo/paseo/tree/main/packages/cli'
    
      15license=('Apache-2.0')
    
      16depends=('nodejs>=22' 'bash' 'glibc' 'gcc-libs')
    
      17provides=('paseo' 'paseo-cli' 'paseo-cli-git')
    
      18conflicts=('paseo' 'paseo-bin' 'paseo-cli' 'paseo-cli-bun' 'paseo-cli-beta' 'paseo-cli-edge' 'paseo-cli-git')
    
      19source=("paseo-cli-git-standalone-${pkgver}.tar.gz::https://github.com/xpufx/xpufx-pkgs/releases/download/arch-x86_64-current/paseo-cli-git-standalone-${pkgver}.tar.gz")
    
      20sha256sums=("$_bin_sha")
    
      21options=('!strip')
    
      22
    
      23package() {
    
      24	# Standalone tarball carries the full usr/ tree (wrapper + node_modules
    
      25	# + licenses) with paseo-cli-git paths; -bin and -git conflict so they
    
      26	# never cohabit. Only the license dir is renamed to this pkgname.
    
      27	tar -xzf "paseo-cli-git-standalone-${pkgver}.tar.gz" -C "${pkgdir}"
    
      28	if [ -d "${pkgdir}/usr/share/licenses/paseo-cli-git" ]; then
    
      29		mv "${pkgdir}/usr/share/licenses/paseo-cli-git" "${pkgdir}/usr/share/licenses/${pkgname}"
    
      30	fi
    
      31	chmod -R go-w "${pkgdir}/usr" 2>/dev/null || true
    
      32	find "${pkgdir}/usr" -type d -exec chmod 755 {} + 2>/dev/null || true
    
      33	chown -R root:root "${pkgdir}" 2>/dev/null || true
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-07 11:14:32	Medium	2