quill-bin

LOW

maintainer samibr 0 votes scanned 2026-11-05 18:10:06.006573

View on AUR

Why flagged

The package installs a prebuilt binary from a release on Codeberg, which is a legitimate forge; while the host is not a major platform like GitHub, it is plausibly controlled by the developer, and the binary is not executed during build but simply installed, limiting supply-chain risk to the integrity of the release artifact.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from a release on Codeberg, which is a legitimate forge; while the host is not a major platform like GitHub, it is plausibly controlled by the developer, and the binary is not executed during build but simply installed, limiting supply-chain risk to the integrity of the release artifact.

PKGBUILD

      1# Maintainer: Sami Ben Romdhane <beromdhane@gmail.com>
    
      2#
    
      3# Prebuilt package: nothing is compiled on the user's machine. The tarball is
    
      4# produced by ../build-release-bin.sh and attached to the release named below.
    
      5# If you host releases somewhere else (GitHub, your own server), change
    
      6# `_upstream` and the tag path in `source` — nothing else depends on the host.
    
      7
    
      8_pkgname=quill
    
      9_upstream="https://codeberg.org/samibr/quill"
    
      10
    
      11pkgname=quill-bin
    
      12pkgver=0.1.0
    
      13pkgrel=1
    
      14pkgdesc="Fast, keyboard-driven terminal email client with conversations, a unified inbox and a real address book (prebuilt binary)"
    
      15arch=('x86_64')
    
      16url="$_upstream"
    
      17license=('MIT')
    
      18depends=('glibc' 'gcc-libs' 'openssl' 'zlib' 'brotli' 'zstd')
    
      19provides=("$_pkgname=$pkgver")
    
      20conflicts=("$_pkgname")
    
      21install="$pkgname.install"
    
      22options=('!strip' '!debug')
    
      23
    
      24_asset="quill-$pkgver-x86_64-linux.tar.gz"
    
      25source=("$_asset::$_upstream/releases/download/v$pkgver/$_asset")
    
      26sha256sums=('cbd958c9e375e8439420017dce923b7d43e26ab0c136878ff87e7a5aaa07053e')
    
      27
    
      28package() {
    
      29  cd "$srcdir/quill-$pkgver-x86_64-linux"
    
      30
    
      31  install -Dm755 quill "$pkgdir/usr/bin/quill"
    
      32  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      33  install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-05 18:10:06	Low	2