pezmax-one-bin

maintainer TakahashiRinta · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads prebuilt Arch packages from GitHub releases without verifying their contents, creating a supply-chain risk if the source is compromised.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package downloads prebuilt Arch packages from GitHub releases without verifying their contents, creating a supply-chain risk if the source is compromised.

PKGBUILD

      1# Maintainer: Takahashi Rinta <mc1586182829@outlook.com>
    
      2#
    
      3# 双架构说明：makepkg 会读取宿主的 $CARCH（x86_64 / aarch64），只下载并校验
    
      4# 对应的 source_$CARCH 数组，因此一份 PKGBUILD 同时服务两个架构。
    
      5#
    
      6# 维护流程（新版本发布时）：
    
      7#   1. 改下面的 pkgver（如需要重打同版本则递增 pkgrel）
    
      8#   2. cd aur && updpkgsums                     # 自动更新 sha256sums_*
    
      9#   3. makepkg --printsrcinfo > .SRCINFO
    
      10#   4. makepkg -si                              # 本地验证一次
    
      11#   5. 把 PKGBUILD 和 .SRCINFO 复制到 AUR git clone 目录，commit + push
    
      12
    
      13pkgname=pezmax-one-bin
    
      14_pkgname=pezmax-one
    
      15pkgver=1.0.0
    
      16pkgrel=1
    
      17pkgdesc="高性能试卷资源管理桌面客户端 (egui + Metro Design)"
    
      18arch=('x86_64' 'aarch64')
    
      19url="https://github.com/PezMax/PezMax-One"
    
      20license=('MIT')
    
      21depends=('wayland' 'dbus' 'libxkbcommon' 'gcc-libs' 'glibc')
    
      22# 以下 X11 / GL 库为 winit 运行时可选（Wayland 用户不需要，X11 用户需要）
    
      23optdepends=(
    
      24  'plasma-workspace: KDE Plasma 全局菜单集成'
    
      25  'libx11: X11 会话支持'
    
      26  'libxi: X11 会话支持'
    
      27  'libxcursor: X11 光标'
    
      28  'libxrender: X11 渲染'
    
      29  'libxkbcommon-x11: X11 键盘布局'
    
      30  'libglvnd: OpenGL / EGL 支持'
    
      31)
    
      32provides=("${_pkgname}")
    
      33conflicts=("${_pkgname}")
    
      34options=('!strip')
    
      35
    
      36_relurl="${url}/releases/download/v${pkgver}"
    
      37source_x86_64=("${_pkgname}-${pkgver}-x86_64.pkg.tar.zst::${_relurl}/${_pkgname}-${pkgver}-linux-x86_64.pkg.tar.zst")
    
      38source_aarch64=("${_pkgname}-${pkgver}-aarch64.pkg.tar.zst::${_relurl}/${_pkgname}-${pkgver}-linux-aarch64.pkg.tar.zst")
    
      39
    
      40# updpkgsums / `makepkg -g` 生成
    
      41sha256sums_x86_64=('ea1d37b603ef8db2c97690a4087e35d94e5d88dbacb26aada62615dfc69a2611')
    
      42sha256sums_aarch64=('fccc24beee4af3314707457184d093d75ed48125025c3a198cfe4390ff294fbd')
    
      43
    
      44package() {
    
      45  # 上游 tarball 本身就是标准 Arch 包，直接把 usr/ 解到 $pkgdir
    
      46  # 元数据文件（.PKGINFO/.MTREE/.BUILDINFO/.INSTALL）由 makepkg 重新生成，需排除
    
      47  bsdtar -xf "${srcdir}/${_pkgname}-${pkgver}-${CARCH}.pkg.tar.zst" -C "${pkgdir}" \
    
      48    --exclude .PKGINFO --exclude .MTREE --exclude .BUILDINFO --exclude .INSTALL
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 07:34:55	MEDIUM	2