pideck-bin

MEDIUM

maintainer duanluan 0 votes scanned 2026-08-31 15:45:42.143005

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release, which is unverifiable and could be silently swapped, posing a supply-chain risk despite the project being open-source.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a GitHub release, which is unverifiable and could be silently swapped, posing a supply-chain risk despite the project being open-source.

PKGBUILD

      1# Maintainer: duanluan <duanluan@outlook.com>
    
      2
    
      3pkgname=pideck-bin
    
      4_pkgname=pi-desktop
    
      5_appname=PiDeck
    
      6pkgver=0.7.2
    
      7pkgrel=1
    
      8pkgdesc='Desktop workbench for managing local AI coding agent sessions (prebuilt binary)'
    
      9arch=('x86_64')
    
      10url='https://github.com/ayuayue/PiDeck'
    
      11license=('MIT')
    
      12depends=(
    
      13  'alsa-lib'
    
      14  'at-spi2-core'
    
      15  'cairo'
    
      16  'dbus'
    
      17  'expat'
    
      18  'glib2'
    
      19  'glibc'
    
      20  'gtk3'
    
      21  'hicolor-icon-theme'
    
      22  'libcups'
    
      23  'libgcc'
    
      24  'libnotify'
    
      25  'libsecret'
    
      26  'libstdc++'
    
      27  'libx11'
    
      28  'libxcb'
    
      29  'libxcomposite'
    
      30  'libxdamage'
    
      31  'libxext'
    
      32  'libxfixes'
    
      33  'libxkbcommon'
    
      34  'libxrandr'
    
      35  'libxss'
    
      36  'libxtst'
    
      37  'mesa'
    
      38  'nspr'
    
      39  'nss'
    
      40  'pango'
    
      41  'systemd-libs'
    
      42  'util-linux-libs'
    
      43  'xdg-utils'
    
      44)
    
      45optdepends=(
    
      46  'git: Git integration'
    
      47  'libappindicator: system tray support'
    
      48  'org.freedesktop.secrets: secret storage backend'
    
      49)
    
      50provides=("pideck=${pkgver}" "${_pkgname}=${pkgver}")
    
      51conflicts=('pideck' 'pi-desktop')
    
      52options=('!strip')
    
      53source=("LICENSE-${pkgver}::https://raw.githubusercontent.com/ayuayue/PiDeck/v${pkgver}/LICENSE")
    
      54source_x86_64=("${_pkgname}_${pkgver}_amd64.deb::https://github.com/ayuayue/PiDeck/releases/download/v${pkgver}/${_pkgname}_${pkgver}_amd64.deb")
    
      55noextract=("${_pkgname}_${pkgver}_amd64.deb")
    
      56sha256sums=('032c3da0b36939e15b0ba21974baeecf2d0afbdf410a66bd76c2ba28e5baccab')
    
      57sha256sums_x86_64=('ffd22c6a24ac4a63f798c4d844e756fe662bfb0411e4d810f188713a26b3ffa7')
    
      58
    
      59package() {
    
      60  local extract_dir="${srcdir}/deb-extract"
    
      61  local data_archives
    
      62
    
      63  rm -rf "${extract_dir}"
    
      64  install -dm755 "${extract_dir}"
    
      65  bsdtar -C "${extract_dir}" -xf "${srcdir}/${_pkgname}_${pkgver}_amd64.deb"
    
      66
    
      67  data_archives=("${extract_dir}"/data.tar.*)
    
      68  if (( ${#data_archives[@]} != 1 )) || [[ ! -f "${data_archives[0]}" ]]; then
    
      69    printf 'unable to locate the Debian data archive\n' >&2
    
      70    return 1
    
      71  fi
    
      72  bsdtar -C "${pkgdir}" -xf "${data_archives[0]}"
    
      73
    
      74  install -dm755 "${pkgdir}/usr/bin"
    
      75  ln -s "/opt/${_appname}/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      76  ln -s "${_pkgname}" "${pkgdir}/usr/bin/pideck"
    
      77
    
      78  chmod 0755 "${pkgdir}/opt/${_appname}/chrome-sandbox"
    
      79  install -Dm644 "${srcdir}/LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      80}
    
      81

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-31 15:45:42	Medium	2