raft-desktop-bin

MEDIUM

maintainer STRRL 0 votes scanned 2026-10-20 19:28:13.414480

View on AUR

Why flagged

The package installs a prebuilt binary (.deb) from GitHub releases without source availability, which presents a supply-chain risk due to lack of verifiability, though it comes from the project's official repository.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary (.deb) from GitHub releases without source availability, which presents a supply-chain risk due to lack of verifiability, though it comes from the project's official repository.

PKGBUILD

      1# Maintainer: Zhiqiang ZHOU <aur@strrl.dev>
    
      2pkgname=raft-desktop-bin
    
      3pkgver=1.21.24
    
      4pkgrel=1
    
      5pkgdesc='Collaborative human and AI messaging desktop app'
    
      6arch=('x86_64')
    
      7url='https://raft.build'
    
      8license=('LicenseRef-custom')
    
      9depends=('bash' 'alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'libgcc' 'hicolor-icon-theme' 'systemd-libs' 'glib2' 'glibc' 'gtk3' 'libcups' 'libdrm' 'libnotify' 'libsecret' 'libx11' 'libxcb' 'libxcomposite' 'libxdamage' 'libxext' 'libxfixes' 'libxkbcommon' 'libxrandr' 'libxss' 'libxtst' 'mesa' 'nspr' 'nss' 'pango' 'util-linux-libs' 'xdg-utils')
    
      10optdepends=('nodejs: run the bundled command line tool' 'libappindicator-gtk3: system tray integration')
    
      11provides=('raft-desktop')
    
      12conflicts=('raft-desktop')
    
      13options=('!strip' '!debug')
    
      14source=("https://github.com/botiverse/desktop/releases/download/v${pkgver}/Raft-Desktop-${pkgver}-amd64.deb")
    
      15sha256sums=('d18a90eb4c22c329410542c57d69dc167a2b0a8243dd9361af80dd3b3c063d0b')
    
      16
    
      17package() {
    
      18  tar -xf data.tar.xz -C "$pkgdir"
    
      19  mv "$pkgdir/opt/Raft Desktop" "$pkgdir/opt/raft-desktop"
    
      20  rm "$pkgdir/opt/raft-desktop/resources/app-update.yml"
    
      21  rm "$pkgdir/opt/raft-desktop/resources/package-type"
    
      22  install -dm755 "$pkgdir/usr/bin"
    
      23  ln -s '/opt/raft-desktop/@botiverseraft-desktop-electron' "$pkgdir/usr/bin/raft-desktop"
    
      24
    
      25  mv "$pkgdir/usr/share/applications/@botiverseraft-desktop-electron.desktop" \
    
      26    "$pkgdir/usr/share/applications/raft-desktop.desktop"
    
      27  sed -i \
    
      28    -e 's|^Exec=.*|Exec=raft-desktop %U|' \
    
      29    -e 's|^Comment=.*|Comment=Collaborative human and AI messaging|' \
    
      30    "$pkgdir/usr/share/applications/raft-desktop.desktop"
    
      31
    
      32  chmod 4755 "$pkgdir/opt/raft-desktop/chrome-sandbox"
    
      33  install -Dm644 "$pkgdir/opt/raft-desktop/LICENSE.electron.txt" \
    
      34    "$pkgdir/usr/share/licenses/$pkgname/LICENSE.electron.txt"
    
      35  install -Dm644 "$pkgdir/opt/raft-desktop/LICENSES.chromium.html" \
    
      36    "$pkgdir/usr/share/licenses/$pkgname/LICENSES.chromium.html"
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-20 19:28:13	Medium	2