routine-bin

LOW

maintainer wit3k 0 votes scanned 2026-10-27 07:47:02.942332

View on AUR

Why flagged

The package downloads a prebuilt binary artifact from the project's official GitLab instance, which is a plausible and controlled source; the worst case of a swapped artifact would be code execution, but the source is project-specific and checksummed, reducing risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt binary artifact from the project's official GitLab instance, which is a plausible and controlled source; the worst case of a swapped artifact would be code execution, but the source is project-specific and checksummed, reducing risk.

PKGBUILD

      1# Maintainer: Witold Adamus <wit3k@users.noreply.gitlab.gnome.org>
    
      2#
    
      3# Binary AUR package: prebuilt /usr install tree from GitLab Generic Packages
    
      4# (uploaded by the tag `release-dist` CI job).
    
      5# Artifact name: routine-<pkgver>-x86_64.tar.zst
    
      6#
    
      7# After each upstream tag: bump pkgver, refresh sha256sums, makepkg --printsrcinfo.
    
      8# If publishing under `routine-gnome-bin`, rename pkgname and adjust conflicts/provides.
    
      9
    
      10pkgname=routine-bin
    
      11pkgver=0.1.0
    
      12pkgrel=1
    
      13pkgdesc='GNOME time-blocking client with local routine-server (prebuilt)'
    
      14url='https://gitlab.gnome.org/wit3k/routine'
    
      15arch=('x86_64')
    
      16license=('GPL-3.0-or-later')
    
      17depends=(
    
      18  'gtk4'
    
      19  'libadwaita'
    
      20  'hicolor-icon-theme'
    
      21)
    
      22provides=('routine')
    
      23conflicts=('routine')
    
      24install=routine-bin.install
    
      25# Project path URL-encoded: wit3k/routine
    
      26_gl_api='https://gitlab.gnome.org/api/v4/projects/wit3k%2Froutine/packages/generic/routine'
    
      27source=(
    
      28  "routine-${pkgver}-x86_64.tar.zst::${_gl_api}/${pkgver}/routine-${pkgver}-x86_64.tar.zst"
    
      29)
    
      30sha256sums=('999ea9a1fac6b1dc6e2eda53fa527fc46882550871af578b42967d08b8bfe93a')
    
      31
    
      32package() {
    
      33  cp -a "$srcdir"/usr "$pkgdir"/
    
      34}
    
      35
    
      36# vim: set ts=2 sw=2 et:
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-27 07:47:02	Low	2