rapidraw-tethering-bin

MEDIUM

maintainer weva 1 votes scanned 2026-09-16 21:23:45.743669

View on AUR

Why flagged

The package downloads a prebuilt .deb from GitHub releases, which is an unverifiable executable binary; if the source were swapped, it could execute arbitrary code, constituting a supply-chain risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package downloads a prebuilt .deb from GitHub releases, which is an unverifiable executable binary; if the source were swapped, it could execute arbitrary code, constituting a supply-chain risk.

PKGBUILD

      1# Maintainer: Valentin Weber
    
      2pkgname="rapidraw-tethering-bin"
    
      3pkgver=1.6.3
    
      4pkgrel=2
    
      5pkgdesc="GPU-accelerated RAW image editor with tethering support"
    
      6
    
      7url="https://github.com/CyberTimon/RapidRAW"
    
      8license=('AGPL-3.0-only')
    
      9arch=('x86_64')
    
      10depends=('libgphoto2' 'hicolor-icon-theme' 'webkit2gtk-4.1' 'gtk3' 'dbus' 'libsoup3' 'glib2' 'cairo' 'gdk-pixbuf2' 'libgcc' 'libstdc++' 'glibc') 
    
      11provides=("rapidraw")
    
      12conflicts=("rapidraw")
    
      13
    
      14sha256sums=('851b436048b3b49898fdbd6e191621b9ff26e9c8b33949ff182597e5e2038c27')
    
      15
    
      16_ubuntuver=24.04
    
      17_debfile="03_tethering_RapidRAW_v${pkgver}_ubuntu-${_ubuntuver}"
    
      18
    
      19source=("$url/releases/download/v${pkgver}/${_debfile}_amd64.deb")
    
      20
    
      21package() {
    
      22	bsdtar -xf data.tar.* -C "$pkgdir" usr
    
      23}
    
      24

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-16 21:23:45	Medium	2