paseo-desktop-bin-edge

MEDIUM

maintainer xpufx 0 votes scanned 2026-09-01 00:11:19.967602

View on AUR

Why flagged

The package downloads a prebuilt .deb binary from GitHub releases without a verifiable build process, posing a supply-chain risk if the source were compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package downloads a prebuilt .deb binary from GitHub releases without a verifiable build process, posing a supply-chain risk if the source were compromised.

PKGBUILD

      1# Maintainer: xpufx <github@xpufx.com>
    
      2pkgname="paseo-desktop-bin-edge"
    
      3pkgver=0.7.0
    
      4_deb_sha='2199c58b6294895b2cb606a543b158877f4c541307041c7c09f4661c2258c42e'
    
      5pkgrel=1
    
      6pkgdesc="One interface for all your Claude Code, Codex and OpenCode agents. (edge - latest upstream release by date, beta or stable)"
    
      7arch=("x86_64")
    
      8url="https://paseo.sh"
    
      9_github_url="https://github.com/getpaseo/paseo"
    
      10makedepends=("binutils" "tar")
    
      11depends=(libxkbcommon libxcb libgcc gtk3 libxext libx11 libcups nspr mesa dbus pango libxcomposite libxrandr nodejs glib2 nss libxdamage alsa-lib systemd-libs bash hicolor-icon-theme cairo at-spi2-core expat libstdc++ libxfixes)
    
      12provides=("paseo=${pkgver}")
    
      13conflicts=(paseo paseo-bin paseo-appimage paseo-desktop-bin paseo-desktop-bin-beta)
    
      14license=("Apache-2.0")
    
      15source=("${_github_url}/releases/download/v${pkgver//_/-}/Paseo-${pkgver//_/-}-amd64.deb")
    
      16sha256sums=("$_deb_sha")
    
      17
    
      18prepare() {
    
      19        ar p Paseo-${pkgver//_/-}-amd64.deb data.tar.xz | tar --zstd -x
    
      20}
    
      21
    
      22package() {
    
      23        cd $srcdir
    
      24        cp -R usr ${pkgdir}
    
      25        cp -R opt ${pkgdir}
    
      26}
    
      27

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-01 00:11:19	Medium	2
2026-08-31 23:46:20	Medium	2