penguin-mail-bin

LOW

maintainer barbuk 0 votes scanned 2026-10-07 14:05:47.471701

View on AUR

Why flagged

The package downloads a prebuilt .pkg.tar.zst from the project's official GitHub releases, which is normal for -bin packages; while the host is not whitelisted, it is the project's own release infrastructure, and the checksum is provided, making this a standard AUR packaging pattern with low risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt .pkg.tar.zst from the project's official GitHub releases, which is normal for -bin packages; while the host is not whitelisted, it is the project's own release infrastructure, and the checksum is provided, making this a standard AUR packaging pattern with low risk.

PKGBUILD

      1# Maintainer: Pivotd <support@penguin-mail.com>
    
      2# Maintainer: Julien Virey <julien.virey+aur@gmail.com>
    
      3
    
      4pkgname=penguin-mail-bin
    
      5pkgver=1.0.0
    
      6pkgrel=1
    
      7pkgdesc="Mail and calendar for Linux (prebuilt binaries from the GitHub release)"
    
      8arch=('x86_64')
    
      9url="https://github.com/c9dev/penguin-mail"
    
      10license=('GPL-3.0-or-later')
    
      11provides=('penguin-mail')
    
      12conflicts=('penguin-mail')
    
      13depends=('gtk4' 'libadwaita' 'webkitgtk-6.0' 'gnupg' 'hicolor-icon-theme')
    
      14optdepends=('gnome-shell-extension-appindicator: tray icon on GNOME Shell'
    
      15            'bubblewrap: run assistant skill scripts')
    
      16options=('!debug')
    
      17
    
      18source=("penguin-mail-$pkgver-1-x86_64.pkg.tar.zst::https://github.com/c9dev/penguin-mail/releases/download/v$pkgver/penguin-mail-$pkgver-1-x86_64.pkg.tar.zst")
    
      19sha256sums=('bad8b0ff00b3117932b5348d7ab6d3915727ad9632c63532da3e6485eb67cdcb')
    
      20
    
      21package() {
    
      22    # The download is already a pacman package tree; lift its files
    
      23    # straight into this one instead of rebuilding them. Its own
    
      24    # .PKGINFO, .BUILDINFO and .MTREE belong to that build, not this one.
    
      25    bsdtar -xf "penguin-mail-$pkgver-1-x86_64.pkg.tar.zst" -C "$pkgdir" \
    
      26        --exclude .PKGINFO --exclude .BUILDINFO --exclude .MTREE
    
      27}
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-07 14:05:47	Low	2