rclone-manager-server

MEDIUM

maintainer Hakanbaban53 0 votes scanned 2026-10-27 07:47:02.942332

View on AUR

Why flagged

The package downloads prebuilt binaries from a GitHub release without a verifiable source build, constituting a supply-chain risk if the release assets were tampered with or swapped.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package downloads prebuilt binaries from a GitHub release without a verifiable source build, constituting a supply-chain risk if the release assets were tampered with or swapped.

PKGBUILD

      1# Maintainer: Hakan İSMAİL <hakanismail53@gmail.com>
    
      2# Pure web server build: no GTK, WebKit, tray or X11 libraries.
    
      3pkgname=rclone-manager-server
    
      4releasetag=0.3.4
    
      5pkgver=0.3.4
    
      6pkgrel=1
    
      7pkgdesc="Manage Rclone from your browser (pure web server, no GUI libraries)"
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://github.com/Zarestia-Dev/rclone-manager"
    
      10license=('GPL-3.0-or-later')
    
      11depends=('glibc' 'gcc-libs' 'dbus')
    
      12optdepends=('rclone: for cloud storage operations'
    
      13            'fuse3: for mounting remote filesystems')
    
      14options=('!strip' '!debug')
    
      15source_x86_64=("${url}/releases/download/headless-v${releasetag}/server-linux-x86_64-${pkgver}.zip")
    
      16source_aarch64=("${url}/releases/download/headless-v${releasetag}/server-linux-aarch64-${pkgver}.zip")
    
      17sha256sums_x86_64=('2c4526d2f93fb5861d423ae3136d6f4e60a0d93b2d3cdda5c373ca41d2251135')
    
      18sha256sums_aarch64=('89b872e4588ba9099e940a3e828522570f75a9a4b16e82c2fef58d8e7136ed84')
    
      19
    
      20package() {
    
      21  cd "${srcdir}/rclone-manager-server"
    
      22
    
      23  install -Dm755 rclone-manager-server "${pkgdir}/usr/bin/rclone-manager-server"
    
      24  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      25
    
      26  # Reuse the upstream unit, minus its manual /opt install notes, pointing at the packaged binary.
    
      27  sed -e '1,/^$/d' \
    
      28      -e 's|/opt/rclone-manager/rclone-manager-server|/usr/bin/rclone-manager-server|' \
    
      29      rclone-manager-server.service > unit.service
    
      30  grep -q '^ExecStart=/usr/bin/rclone-manager-server' unit.service
    
      31  install -Dm644 unit.service "${pkgdir}/usr/lib/systemd/system/rclone-manager-server.service"
    
      32
    
      33  # Service account and its state directory, created by pacman's systemd hooks.
    
      34  install -dm755 "${pkgdir}/usr/lib/sysusers.d" "${pkgdir}/usr/lib/tmpfiles.d"
    
      35  echo 'u rclone-manager - "RClone Manager Server" /var/lib/rclone-manager /usr/bin/nologin' \
    
      36    > "${pkgdir}/usr/lib/sysusers.d/${pkgname}.conf"
    
      37  echo 'd /var/lib/rclone-manager 0750 rclone-manager rclone-manager -' \
    
      38    > "${pkgdir}/usr/lib/tmpfiles.d/${pkgname}.conf"
    
      39}
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-27 07:47:02	Medium	2