positron-ide-bin
LOW
maintainer Qingxu
6 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt .deb from Posit's official CDN (cdn.posit.co), which is a legitimate source for the project; the binary is not executed during build but unpacked and installed, and the checksums are provided and valid, making the risk low despite the non-whitelisted host.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from Posit's official CDN (cdn.posit.co), which is a legitimate source for the project; the binary is not executed during build but unpacked and installed, and the checksums are provided and valid, making the risk low despite the non-whitelisted host.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:62
"$pkgname-$pkgver-x86_64.deb::https://cdn.posit.co/positron/releases/deb/x86_64/Positron-${_upstream_pkgver}-x64.deb"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Qingxu <me@linioi.com>
2
pkgname=positron-ide-bin
3
pkgver=2026.08.1.2
4
_upstream_pkgver=${pkgver%.*}-${pkgver##*.}
5
pkgrel=1
6
pkgdesc='A next-generation data science IDE from Posit'
7
arch=(
8
'x86_64'
9
'aarch64'
10
)
11
url='https://github.com/posit-dev/positron'
12
license=(
13
'Elastic-2.0'
14
)
15
depends=(
16
'alsa-lib'
17
'at-spi2-core'
18
'cairo'
19
'dbus'
20
'expat'
21
'glib2'
22
'gtk3'
23
'libcups'
24
'libsecret'
25
'libx11'
26
'libxcb'
27
'libxcomposite'
28
'libxdamage'
29
'libxext'
30
'libxfixes'
31
'libxkbcommon'
32
'libxkbfile'
33
'libxrandr'
34
'mesa'
35
'nspr'
36
'nss'
37
'pango'
38
'systemd-libs'
39
'xdg-utils'
40
)
41
optdepends=(
42
'bash-completion: command-line completion'
43
'nodejs: Node.js runtime support'
44
'python: Python runtime support'
45
'r: R runtime support'
46
'vulkan-intel: Intel Vulkan driver'
47
'vulkan-radeon: Radeon Vulkan driver'
48
'vulkan-icd-loader: Vulkan ICD loader'
49
'webkit2gtk-4.1: Microsoft account authentication'
50
)
51
provides=(
52
'positron-ide'
53
)
54
conflicts=(
55
'positron-ide-devel-bin'
56
)
57
options=(
58
'!strip'
59
'!debug'
60
)
61
source_x86_64=(
62
"$pkgname-$pkgver-x86_64.deb::https://cdn.posit.co/positron/releases/deb/x86_64/Positron-${_upstream_pkgver}-x64.deb"
63
)
64
source_aarch64=(
65
"$pkgname-$pkgver-aarch64.deb::https://cdn.posit.co/positron/releases/deb/arm64/Positron-${_upstream_pkgver}-arm64.deb"
66
)
67
noextract=(
68
"$pkgname-$pkgver-x86_64.deb"
69
"$pkgname-$pkgver-aarch64.deb"
70
)
71
sha256sums_x86_64=('e307d3710b054de4236b62591702419887d73bdb65e8253f279fc7663d3ced89')
72
sha256sums_aarch64=('78ccb9b8f25f6a0c99fd233367f6675c24001bf54347d5ad694423020976d7ca')
73
74
package() {
75
local _deb
76
77
case "$CARCH" in
78
x86_64)
79
_deb="$srcdir/$pkgname-$pkgver-x86_64.deb"
80
;;
81
aarch64)
82
_deb="$srcdir/$pkgname-$pkgver-aarch64.deb"
83
;;
84
esac
85
86
ar p "$_deb" data.tar.xz | bsdtar -xJf - -C "$pkgdir"
87
88
install -dm755 \
89
"$pkgdir/usr/bin" \
90
"$pkgdir/usr/share/licenses/$pkgname"
91
92
ln -s /usr/share/positron/bin/positron "$pkgdir/usr/bin/positron"
93
94
sed -i \
95
-e 's|^Exec=/usr/share/positron/positron %F$|Exec=/usr/bin/positron %F|' \
96
-e 's|^Exec=/usr/share/positron/positron --new-window %F$|Exec=/usr/bin/positron --new-window %F|' \
97
"$pkgdir/usr/share/applications/positron.desktop"
98
99
sed -i \
100
-e 's|^Exec=/usr/share/positron/positron --open-url %U$|Exec=/usr/bin/positron --open-url %U|' \
101
"$pkgdir/usr/share/applications/positron-url-handler.desktop"
102
103
chmod 4755 "$pkgdir/usr/share/positron/chrome-sandbox"
104
105
# Fix world-writable files from upstream .deb
106
find "$pkgdir" -type f -perm /0002 -exec chmod o-w {} +
107
108
install -Dm644 \
109
"$pkgdir/usr/share/positron/resources/app/LICENSE.txt" \
110
"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
111
install -Dm644 \
112
"$pkgdir/usr/share/positron/resources/app/NOTICE" \
113
"$pkgdir/usr/share/licenses/$pkgname/NOTICE"
114
install -Dm644 \
115
"$pkgdir/usr/share/positron/resources/app/ThirdPartyNotices.txt" \
116
"$pkgdir/usr/share/licenses/$pkgname/ThirdPartyNotices.txt"
117
install -Dm644 \
118
"$pkgdir/usr/share/positron/LICENSES.chromium.html" \
119
"$pkgdir/usr/share/licenses/$pkgname/LICENSES.chromium.html"
120
}
121
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |