riko-bin

maintainer OpenSourceGuy · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt binary from a Debian package hosted on GitHub, which is not verifiable from source, creating a supply-chain risk if the release artifact were swapped.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a Debian package hosted on GitHub, which is not verifiable from source, creating a supply-chain risk if the release artifact were swapped.

PKGBUILD

      1# Maintainer: OpenSourceGuy <osguy@duck.com>
    
      2
    
      3pkgname=riko-bin
    
      4_pkgname=riko-launcher
    
      5pkgver=0.1.0
    
      6pkgrel=1
    
      7pkgdesc="Fast, native launcher for Vortex (a Roblox alternative) with plugins and a plugin marketplace"
    
      8arch=('x86_64')
    
      9url='https://github.com/Arbuzyonak/Riko'
    
      10license=('MIT' 'Apache-2.0')
    
      11depends=(
    
      12  'webkit2gtk-4.1' 'gtk3' 'libayatana-appindicator' 'librsvg'
    
      13  'xdotool' 'openssl' 'gst-plugins-base' 'gst-plugins-good' 'wine'
    
      14)
    
      15optdepends=(
    
      16  'vulkan-driver: Vulkan support for Vortex under Wine'
    
      17  'lib32-vulkan-driver: 32-bit Vulkan drivers (may be needed for 32-bit Wine games)'
    
      18  'mangohud: optional in-game overlay (built-in plugin)'
    
      19)
    
      20provides=("${_pkgname}")
    
      21conflicts=("${_pkgname}")
    
      22replaces=("${_pkgname}")
    
      23options=('!strip' '!emptydirs')
    
      24
    
      25_deb="Riko.Launcher_${pkgver}_amd64.deb"
    
      26source=("${_deb}::${url}/releases/download/v${pkgver}/${_deb}"
    
      27        "LICENSE-MIT::${url}/raw/v${pkgver}/LICENSE-MIT"
    
      28        "LICENSE-APACHE::${url}/raw/v${pkgver}/LICENSE-APACHE")
    
      29sha256sums=('bc1f8012ba542f9b117e18b5d1eb03720325917f02f816c63b7115367b030908'
    
      30            '46707a13cde1870aa6dd3e5ba4d5533a22291f637ce5088e585a15ebab69fc5f'
    
      31            '8ac58428d6dcbaea653ad898518314726f14de5a5be643089abf63cad925e67c')
    
      32noextract=("${_deb}")
    
      33
    
      34package() {
    
      35  local _extract="${srcdir}/deb-extract"
    
      36  mkdir -p "${_extract}"
    
      37
    
      38  local _data
    
      39  _data=$(bsdtar -tf "${srcdir}/${_deb}" | grep -oP '^data\.tar\.[a-z0-9]+$' | head -1)
    
      40  bsdtar -xOf "${srcdir}/${_deb}" "${_data}" | bsdtar -xzf - -C "${_extract}"
    
      41
    
      42  install -Dm755 "${_extract}/usr/bin/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      43  install -Dm644 "${_extract}/usr/share/applications/Riko Launcher.desktop" \
    
      44                  "${pkgdir}/usr/share/applications/Riko Launcher.desktop"
    
      45
    
      46  local _size
    
      47  for _size in 32x32 128x128 512x512; do
    
      48    install -Dm644 "${_extract}/usr/share/icons/hicolor/${_size}/apps/${_pkgname}.png" \
    
      49                    "${pkgdir}/usr/share/icons/hicolor/${_size}/apps/${_pkgname}.png"
    
      50  done
    
      51
    
      52  install -Dm644 "${srcdir}/LICENSE-MIT"    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE-MIT"
    
      53  install -Dm644 "${srcdir}/LICENSE-APACHE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE-APACHE"
    
      54}
    
      55
    
      56# vim:set ts=2 sw=2 et:
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 05:27:22	MEDIUM	2