picot-bin

maintainer jinzhongjia · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs a prebuilt Debian binary from a GitHub release, which is a normal distribution method for upstream; the binary is not executed at build time, and the source is verifiable via checksum, making the risk low despite the host not being a standard whitelist entry.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 90%): The package installs a prebuilt Debian binary from a GitHub release, which is a normal distribution method for upstream; the binary is not executed at build time, and the source is verifiable via checksum, making the risk low despite the host not being a standard whitelist entry.

PKGBUILD

      1# Maintainer: jinzhongjia <mail@nvimer.org>
    
      2
    
      3pkgname=picot-bin
    
      4pkgver=0.3.1
    
      5pkgrel=1
    
      6pkgdesc="Local Codex-style desktop GUI for the Pi coding agent"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://github.com/shixin-guo/picot"
    
      9license=('MIT')
    
      10depends=(
    
      11    'cairo'
    
      12    'dbus'
    
      13    'gdk-pixbuf2'
    
      14    'glib2'
    
      15    'glibc'
    
      16    'gcc-libs'
    
      17    'gtk3'
    
      18    'hicolor-icon-theme'
    
      19    'libsoup3'
    
      20    'pango'
    
      21    'webkit2gtk-4.1'
    
      22)
    
      23# Upstream renamed the project pi-studio -> picot; this package supersedes
    
      24# pi-studio-bin. replaces= migrates existing installs on -Syu.
    
      25provides=('picot' 'pi-studio')
    
      26replaces=('pi-studio-bin')
    
      27conflicts=('picot' 'pi-studio-bin')
    
      28options=('!strip' '!debug')
    
      29
    
      30_relurl="${url}/releases/download/v${pkgver}"
    
      31
    
      32source_x86_64=("${pkgname}-${pkgver}-x86_64.deb::${_relurl}/Picot_${pkgver}_amd64.deb")
    
      33sha256sums_x86_64=('ea0db8a89884ec8ba8c43f8a50477051b61ef55ceaab9103557ad7ce9537e5a0')
    
      34source_aarch64=("${pkgname}-${pkgver}-aarch64.deb::${_relurl}/Picot_${pkgver}_arm64.deb")
    
      35sha256sums_aarch64=('2271ebac63faddea298ac016ce47b83aaf97d8b945b0aa983d11a5646e3773ba')
    
      36
    
      37prepare() {
    
      38    mkdir -p "${srcdir}/data"
    
      39    cd "${srcdir}/data"
    
      40    ar x "${srcdir}/${pkgname}-${pkgver}-${CARCH}.deb"
    
      41    tar xzf data.tar.gz
    
      42}
    
      43
    
      44package() {
    
      45    cd "${srcdir}/data"
    
      46
    
      47    install -Dm755 usr/bin/picot "${pkgdir}/usr/bin/picot"
    
      48
    
      49    install -d "${pkgdir}/usr/lib/Picot"
    
      50    cp -a usr/lib/Picot/. "${pkgdir}/usr/lib/Picot/"
    
      51
    
      52    install -Dm644 usr/share/icons/hicolor/32x32/apps/picot.png \
    
      53        "${pkgdir}/usr/share/icons/hicolor/32x32/apps/picot.png"
    
      54    install -Dm644 usr/share/icons/hicolor/128x128/apps/picot.png \
    
      55        "${pkgdir}/usr/share/icons/hicolor/128x128/apps/picot.png"
    
      56    if [[ -d usr/share/icons/hicolor/256x256@2 ]]; then
    
      57        install -Dm644 "usr/share/icons/hicolor/256x256@2/apps/picot.png" \
    
      58            "${pkgdir}/usr/share/icons/hicolor/256x256/apps/picot.png"
    
      59    fi
    
      60
    
      61    install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/picot.desktop" <<'EOF'
    
      62[Desktop Entry]
    
      63Type=Application
    
      64Name=Picot
    
      65Comment=Local Codex-style desktop GUI for the Pi coding agent
    
      66Exec=picot
    
      67Icon=picot
    
      68Terminal=false
    
      69Categories=Development;
    
      70StartupWMClass=picot
    
      71EOF
    
      72
    
      73    # Upstream declares MIT in package.json but ships no LICENSE file
    
      74    install -d "${pkgdir}/usr/share/licenses/${pkgname}"
    
      75}
    
      76

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: jinzhongjia <mail@nvimer.org>
 
 pkgname=picot-bin
-pkgver=0.3.0
+pkgver=0.3.1
 pkgrel=1
 pkgdesc="Local Codex-style desktop GUI for the Pi coding agent"
 arch=('x86_64' 'aarch64')
@@ -30,9 +30,9 @@
 _relurl="${url}/releases/download/v${pkgver}"
 
 source_x86_64=("${pkgname}-${pkgver}-x86_64.deb::${_relurl}/Picot_${pkgver}_amd64.deb")
-sha256sums_x86_64=('80ffc2658bcccb8f89d149c705cd8252865e77d25bdfa7a418e5b9bc29ac8126')
+sha256sums_x86_64=('ea0db8a89884ec8ba8c43f8a50477051b61ef55ceaab9103557ad7ce9537e5a0')
 source_aarch64=("${pkgname}-${pkgver}-aarch64.deb::${_relurl}/Picot_${pkgver}_arm64.deb")
-sha256sums_aarch64=('6b157758de3ff82a73c7c8eee91b4a80e50ad80cb1b23c2eb0335e54236d280e')
+sha256sums_aarch64=('2271ebac63faddea298ac016ce47b83aaf97d8b945b0aa983d11a5646e3773ba')
 
 prepare() {
     mkdir -p "${srcdir}/data"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 03:17:12	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 19:25:44	LOW	2