rive-cli-bin

MEDIUM

maintainer That1Calculator 0 votes scanned 2026-11-02 20:06:34.285075

View on AUR

Why flagged

Installs a prebuilt binary from releases.rive.app, which is plausibly the official Rive release infrastructure but is a non-whitelisted host; the binary is executed directly and the checksum is present, making this a moderate supply-chain risk if the host were compromised, but not clearly malicious.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("${pkgname}-${pkgver}-linux-x64.tar.gz::https://releases.rive.app/cli/v${pkgver}/rive-linux-x64.tar.gz")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs a prebuilt binary from releases.rive.app, which is plausibly the official Rive release infrastructure but is a non-whitelisted host; the binary is executed directly and the checksum is present, making this a moderate supply-chain risk if the host were compromised, but not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kainoa Kanter <kainoa@t1c.dev>
    
      2
    
      3pkgname=rive-cli-bin
    
      4pkgver=1.8.0
    
      5pkgrel=1
    
      6pkgdesc='Command-line tools for creating, previewing, and publishing Rive graphics'
    
      7arch=('x86_64')
    
      8url='https://rive.app/'
    
      9license=('LicenseRef-unknown')
    
      10depends=(
    
      11  'glibc'
    
      12  'libgcc'
    
      13  'libstdc++'
    
      14  'zlib'
    
      15  'libglvnd'
    
      16  'libx11'
    
      17  'wayland'
    
      18  'libxkbcommon'
    
      19)
    
      20optdepends=('xdg-utils: open browser links for authentication')
    
      21provides=("rive-cli=${pkgver}")
    
      22conflicts=('rive-cli')
    
      23options=('!strip' '!debug')
    
      24source=("${pkgname}-${pkgver}-linux-x64.tar.gz::https://releases.rive.app/cli/v${pkgver}/rive-linux-x64.tar.gz")
    
      25sha256sums=('9d67bdb77e33db2daa7ce80df51579212ff0cf55a9d6ae3696e4608a248847af')
    
      26
    
      27package() {
    
      28  cd "${srcdir}"
    
      29
    
      30  # Rive looks for docs/ and samples/ beside its executable.
    
      31  install -Dm755 rive "${pkgdir}/opt/rive-cli/rive"
    
      32  cp -a docs samples "${pkgdir}/opt/rive-cli/"
    
      33
    
      34  install -d "${pkgdir}/usr/bin"
    
      35  ln -s /opt/rive-cli/rive "${pkgdir}/usr/bin/rive"
    
      36}
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-02 20:06:34	Medium	3
2026-11-02 20:03:06	Medium	2