quantum-desktop

MEDIUM

maintainer itonia149 0 votes scanned 2026-09-19 03:30:07.586967

View on AUR

Why flagged

Downloads a prebuilt binary from a GitHub release of a forked project with no official release presence, creating a supply-chain risk if the host is compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): Downloads a prebuilt binary from a GitHub release of a forked project with no official release presence, creating a supply-chain risk if the host is compromised.

PKGBUILD

      1# Maintainer: itonia149 <283548443+itonia149@users.noreply.github.com>
    
      2pkgname=quantum-desktop
    
      3pkgver=1.0.1
    
      4pkgrel=1
    
      5pkgdesc='Local FileBrowser Quantum desktop integration with browser-based file management'
    
      6arch=('x86_64')
    
      7url='https://github.com/itonia149/quantum-desktop'
    
      8license=('MIT' 'Apache-2.0')
    
      9depends=('python>=3.10' 'systemd' 'microsoft-edge-stable-bin')
    
      10checkdepends=('desktop-file-utils')
    
      11optdepends=('ffmpeg: video previews and thumbnails')
    
      12options=('!strip' '!debug')
    
      13_qver=1.5.6-stable
    
      14source=("$pkgname-$pkgver.tar.gz::$url/releases/download/v$pkgver/$pkgname-$pkgver.tar.gz"
    
      15        "quantum-$_qver::https://github.com/gtsteffaniak/filebrowser/releases/download/v$_qver/linux-amd64-filebrowser"
    
      16        "quantum-LICENSE-$_qver::https://raw.githubusercontent.com/gtsteffaniak/filebrowser/v$_qver/LICENSE")
    
      17sha256sums=('0522e460ef86c1ae28754e88c6bf6240b7dbbf04aea408e2d7858bc9a3485199'
    
      18            'febf1ded3368eac1f13481f413db272c57678b70f09e74f5513d5e25e0bfb0e5'
    
      19            '47ce67778fa9640ab20c2414ab2d073430099bbbf6de163f8d215d3abc4a171c')
    
      20check() {
    
      21  cd "$srcdir/$pkgname-$pkgver"
    
      22  python -m unittest -v
    
      23  desktop-file-validate packaging/filebrowser-quantum-local.desktop
    
      24}
    
      25package() {
    
      26  install -Dm755 "$srcdir/quantum-$_qver" "$pkgdir/usr/lib/$pkgname/filebrowser"
    
      27  cd "$srcdir/$pkgname-$pkgver"
    
      28  install -Dm755 quantum-desktop "$pkgdir/usr/bin/quantum-desktop"
    
      29  install -Dm755 quantum-desktop-setup "$pkgdir/usr/bin/quantum-desktop-setup"
    
      30  install -Dm644 packaging/filebrowser-quantum-local.desktop "$pkgdir/usr/share/applications/filebrowser-quantum-local.desktop"
    
      31  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      32  install -Dm644 "$srcdir/quantum-LICENSE-$_qver" "$pkgdir/usr/share/licenses/$pkgname/QUANTUM-LICENSE"
    
      33  install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-19 03:30:07	Medium	2