repo-notes-bin

maintainer timmo001 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt binary from a GitHub release with a skipped checksum for non-architecture-specific sources, creating an unverifiable supply chain risk for the shell completion and license files, though the main binary is checksum-verified.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt binary from a GitHub release with a skipped checksum for non-architecture-specific sources, creating an unverifiable supply chain risk for the shell completion and license files, though the main binary is checksum-verified.

PKGBUILD

      1#!/bin/sh
    
      2# Maintainer: Aidan Timson (Timmo) <aidan@timmo.dev>
    
      3pkgname=repo-notes-bin
    
      4pkgver=20260729.0
    
      5pkgrel=1
    
      6pkgdesc="Standalone CLI and MCP server for repository notes (prebuilt binary)"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://github.com/timmo001/notes"
    
      9license=('Apache-2.0')
    
      10depends=('glibc' 'git')
    
      11provides=('repo-notes')
    
      12conflicts=('repo-notes' 'repo-notes-git')
    
      13options=('!strip')
    
      14install=repo-notes.install
    
      15source=('notes.bash' 'notes.fish' '_notes' 'LICENSE')
    
      16source_x86_64=("repo-notes-${pkgver}-linux-${CARCH}.tar.gz::$url/releases/download/${pkgver}/repo-notes-${pkgver}-linux-${CARCH}.tar.gz")
    
      17source_aarch64=("repo-notes-${pkgver}-linux-${CARCH}.tar.gz::$url/releases/download/${pkgver}/repo-notes-${pkgver}-linux-${CARCH}.tar.gz")
    
      18sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP')
    
      19sha256sums_x86_64=('aa1f22fdd7f5f1e5a3407b208ce4af4714afb28099e2b091c0863d4dd67aabdb')
    
      20sha256sums_aarch64=('4cc61b04094874f4cf54c3183f0597f46dde2ab3282c12491571fd8313f3ec36')
    
      21
    
      22package() {
    
      23  install -Dm755 notes "$pkgdir/usr/bin/notes"
    
      24  ln -s notes "$pkgdir/usr/bin/note"
    
      25  ln -s notes "$pkgdir/usr/bin/handoffs"
    
      26  ln -s notes "$pkgdir/usr/bin/handoff"
    
      27  install -Dm644 notes.bash "$pkgdir/usr/share/bash-completion/completions/notes"
    
      28  install -Dm644 notes.fish "$pkgdir/usr/share/fish/vendor_completions.d/notes.fish"
    
      29  install -Dm644 _notes "$pkgdir/usr/share/zsh/site-functions/_notes"
    
      30  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      31}
    
      32

Changes since previous scan

--- PKGBUILD @ 2026-07-29 00:25
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 #!/bin/sh
 # Maintainer: Aidan Timson (Timmo) <aidan@timmo.dev>
 pkgname=repo-notes-bin
-pkgver=20260720.2
+pkgver=20260729.0
 pkgrel=1
 pkgdesc="Standalone CLI and MCP server for repository notes (prebuilt binary)"
 arch=('x86_64' 'aarch64')
@@ -11,12 +11,13 @@
 provides=('repo-notes')
 conflicts=('repo-notes' 'repo-notes-git')
 options=('!strip')
+install=repo-notes.install
 source=('notes.bash' 'notes.fish' '_notes' 'LICENSE')
 source_x86_64=("repo-notes-${pkgver}-linux-${CARCH}.tar.gz::$url/releases/download/${pkgver}/repo-notes-${pkgver}-linux-${CARCH}.tar.gz")
 source_aarch64=("repo-notes-${pkgver}-linux-${CARCH}.tar.gz::$url/releases/download/${pkgver}/repo-notes-${pkgver}-linux-${CARCH}.tar.gz")
 sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP')
-sha256sums_x86_64=('bfed6f7cf74e68cd51467d6cfdc88ca0895a873705f5041a4ccc9e948ce7a6c1')
-sha256sums_aarch64=('728469763fb3da3d456ace7b85dd61e162d7185f9dc29263d91a25cc7ca1b2c1')
+sha256sums_x86_64=('aa1f22fdd7f5f1e5a3407b208ce4af4714afb28099e2b091c0863d4dd67aabdb')
+sha256sums_aarch64=('4cc61b04094874f4cf54c3183f0597f46dde2ab3282c12491571fd8313f3ec36')
 
 package() {
   install -Dm755 notes "$pkgdir/usr/bin/notes"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 23:13:22	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 19:14:42	MEDIUM	2