positron-ide-bin
LOW
maintainer Qingxu
6 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt .deb from Posit's official CDN (cdn.posit.co), which is a legitimate source for the project; the binary is not executed during build, and the host, while not a standard forge, is project-specific and trustworthy.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from Posit's official CDN (cdn.posit.co), which is a legitimate source for the project; the binary is not executed during build, and the host, while not a standard forge, is project-specific and trustworthy.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:62
"$pkgname-$pkgver-x86_64.deb::https://cdn.posit.co/positron/releases/deb/x86_64/Positron-${_upstream_pkgver}-x64.deb"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Qingxu <me@linioi.com>
2
pkgname=positron-ide-bin
3
pkgver=2026.10.2.3
4
_upstream_pkgver=${pkgver%.*}-${pkgver##*.}
5
pkgrel=1
6
pkgdesc='A next-generation data science IDE from Posit'
7
arch=(
8
'x86_64'
9
'aarch64'
10
)
11
url='https://github.com/posit-dev/positron'
12
license=(
13
'Elastic-2.0'
14
)
15
depends=(
16
'alsa-lib'
17
'at-spi2-core'
18
'cairo'
19
'dbus'
20
'expat'
21
'glib2'
22
'gtk3'
23
'libcups'
24
'libsecret'
25
'libx11'
26
'libxcb'
27
'libxcomposite'
28
'libxdamage'
29
'libxext'
30
'libxfixes'
31
'libxkbcommon'
32
'libxkbfile'
33
'libxrandr'
34
'mesa'
35
'nspr'
36
'nss'
37
'pango'
38
'systemd-libs'
39
'xdg-utils'
40
)
41
optdepends=(
42
'bash-completion: command-line completion'
43
'nodejs: Node.js runtime support'
44
'python: Python runtime support'
45
'r: R runtime support'
46
'vulkan-intel: Intel Vulkan driver'
47
'vulkan-radeon: Radeon Vulkan driver'
48
'vulkan-icd-loader: Vulkan ICD loader'
49
'webkit2gtk-4.1: Microsoft account authentication'
50
)
51
provides=(
52
'positron-ide'
53
)
54
conflicts=(
55
'positron-ide-devel-bin'
56
)
57
options=(
58
'!strip'
59
'!debug'
60
)
61
source_x86_64=(
62
"$pkgname-$pkgver-x86_64.deb::https://cdn.posit.co/positron/releases/deb/x86_64/Positron-${_upstream_pkgver}-x64.deb"
63
)
64
source_aarch64=(
65
"$pkgname-$pkgver-aarch64.deb::https://cdn.posit.co/positron/releases/deb/arm64/Positron-${_upstream_pkgver}-arm64.deb"
66
)
67
noextract=(
68
"$pkgname-$pkgver-x86_64.deb"
69
"$pkgname-$pkgver-aarch64.deb"
70
)
71
sha256sums_x86_64=('2131efacd9d0227cf50db49c1ced2d976745342200a946ebbe1d95e78e6d6601')
72
sha256sums_aarch64=('cf2d524dfceba8abf2c62104e2dd7fe173da5c5ac63fad40ffa7581f857a7c7c')
73
74
package() {
75
local _deb
76
77
case "$CARCH" in
78
x86_64)
79
_deb="$srcdir/$pkgname-$pkgver-x86_64.deb"
80
;;
81
aarch64)
82
_deb="$srcdir/$pkgname-$pkgver-aarch64.deb"
83
;;
84
esac
85
86
ar p "$_deb" data.tar.xz | bsdtar -xJf - -C "$pkgdir"
87
88
install -dm755 \
89
"$pkgdir/usr/bin" \
90
"$pkgdir/usr/share/licenses/$pkgname"
91
92
ln -s /usr/share/positron/bin/positron "$pkgdir/usr/bin/positron"
93
94
sed -i \
95
-e 's|^Exec=/usr/share/positron/positron %F$|Exec=/usr/bin/positron %F|' \
96
-e 's|^Exec=/usr/share/positron/positron --new-window %F$|Exec=/usr/bin/positron --new-window %F|' \
97
"$pkgdir/usr/share/applications/positron.desktop"
98
99
sed -i \
100
-e 's|^Exec=/usr/share/positron/positron --open-url %U$|Exec=/usr/bin/positron --open-url %U|' \
101
"$pkgdir/usr/share/applications/positron-url-handler.desktop"
102
103
chmod 4755 "$pkgdir/usr/share/positron/chrome-sandbox"
104
105
# Fix world-writable files from upstream .deb
106
find "$pkgdir" -type f -perm /0002 -exec chmod o-w {} +
107
108
install -Dm644 \
109
"$pkgdir/usr/share/positron/resources/app/LICENSE.txt" \
110
"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
111
install -Dm644 \
112
"$pkgdir/usr/share/positron/resources/app/NOTICE" \
113
"$pkgdir/usr/share/licenses/$pkgname/NOTICE"
114
install -Dm644 \
115
"$pkgdir/usr/share/positron/resources/app/ThirdPartyNotices.txt" \
116
"$pkgdir/usr/share/licenses/$pkgname/ThirdPartyNotices.txt"
117
install -Dm644 \
118
"$pkgdir/usr/share/positron/LICENSES.chromium.html" \
119
"$pkgdir/usr/share/licenses/$pkgname/LICENSES.chromium.html"
120
}
121
Changes since previous scan
--- PKGBUILD @ 2026-10-27 00:23+++ PKGBUILD @ 2026-11-01 00:21@@ -1,6 +1,6 @@ # Maintainer: Qingxu <me@linioi.com> pkgname=positron-ide-bin-pkgver=2026.10.1.2+pkgver=2026.10.2.3 _upstream_pkgver=${pkgver%.*}-${pkgver##*.} pkgrel=1 pkgdesc='A next-generation data science IDE from Posit'@@ -68,8 +68,8 @@ "$pkgname-$pkgver-x86_64.deb" "$pkgname-$pkgver-aarch64.deb" )-sha256sums_x86_64=('e09b722eaace3970fa6dca8fc011c18fa0933a1fe50ae1146f528afe03d632fa')-sha256sums_aarch64=('c8a186e87e73f0ac4ea62bd033b99152765326e87ff5f68e85b68618c546ae06')+sha256sums_x86_64=('2131efacd9d0227cf50db49c1ced2d976745342200a946ebbe1d95e78e6d6601')+sha256sums_aarch64=('cf2d524dfceba8abf2c62104e2dd7fe173da5c5ac63fad40ffa7581f857a7c7c') package() { local _debScan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 07:47:02 | Medium | 1 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 05:30:25 | Medium | 1 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |