rnazar-bin

MEDIUM

maintainer jnmbk 0 votes scanned 2026-10-24 05:39:24.161025

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release without a source build, making the payload unverifiable; while the host (GitHub) is generally trustworthy, the lack of transparency in the binary's origin constitutes a supply-chain risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 80%): The package installs a prebuilt binary from a GitHub release without a source build, making the payload unverifiable; while the host (GitHub) is generally trustworthy, the lack of transparency in the binary's origin constitutes a supply-chain risk.

PKGBUILD

      1# Maintainer: jnmbk <ugur.jnmbk@gmail.com>
    
      2pkgname=rnazar-bin
    
      3_pkgname=rnazar
    
      4pkgver=0.8.3
    
      5pkgrel=1
    
      6pkgdesc="System tray evil eye ward and crash notifier"
    
      7arch=('x86_64')
    
      8url="https://github.com/jnmbk/rnazar"
    
      9license=('MIT')
    
      10depends=(
    
      11  'cairo'
    
      12  'gdk-pixbuf2'
    
      13  'glib2'
    
      14  'glibc'
    
      15  'gtk3'
    
      16  'hicolor-icon-theme'
    
      17  'libgcc'
    
      18)
    
      19provides=("$_pkgname")
    
      20conflicts=("$_pkgname")
    
      21source_x86_64=("$url/releases/download/v$pkgver/$_pkgname-$pkgver-1-$arch.pkg.tar.zst")
    
      22sha256sums_x86_64=('3baa4a1f32465c73583768c785e66dd80c9d326491d1899b3ac520fbe3db1d68')
    
      23
    
      24package() {
    
      25    cp -a "$srcdir/usr" "$pkgdir/"
    
      26    if [ -f "$srcdir/usr/share/licenses/$_pkgname/LICENSE" ] && [ ! -d "$pkgdir/usr/share/licenses/$pkgname" ]; then
    
      27      install -dm0755 "$pkgdir/usr/share/licenses/$pkgname"
    
      28      ln -s "/usr/share/licenses/$_pkgname/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      29    fi
    
      30}
    
      31
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-24 05:39:24	Medium	2