reticulum-meshchatx-bin

MEDIUM

maintainer rkevin 0 votes scanned 2026-09-27 07:16:53.263382

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release without source code availability, creating a supply-chain risk if the release artifact is compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a GitHub release without source code availability, creating a supply-chain risk if the release artifact is compromised.

PKGBUILD

      1# Maintainer: RK <rk@rkevin.dev>
    
      2
    
      3pkgname=reticulum-meshchatx-bin
    
      4pkgver=4.9.1
    
      5pkgrel=1
    
      6pkgdesc='All-in-one Reticulum client, fork of Reticulum MeshChat'
    
      7arch=('x86_64')
    
      8url="https://github.com/Quad4-Software/MeshChatX"
    
      9license=('0BSD')
    
      10source=("${url}/releases/download/v${pkgver}/ReticulumMeshChatX-v${pkgver}-linux-amd64.deb")
    
      11sha256sums=('25a13a39a7fa264b35a0ad2ac5e01691bbc4162e8e673b1afc8bd3dbdb645ca5')
    
      12
    
      13package() {
    
      14    tar xf data.tar.xz
    
      15    mkdir -p "$pkgdir/opt/" "$pkgdir/usr/bin/"
    
      16    cp -ar 'opt/Reticulum MeshChatX/' "$pkgdir/opt/"
    
      17    cp -ar 'usr/share/' "$pkgdir/usr/"
    
      18    ln -s '/opt/Reticulum MeshChatX/reticulum-meshchatx' "$pkgdir/usr/bin/reticulum-meshchatx"
    
      19}
    
      20

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-27 07:16:53	Medium	2