sable-bin

maintainer eleboucher · 0 votes · scanned 2026-08-18 01:38:17.845211

MEDIUM

Why flagged The package installs a prebuilt .deb from a GitHub release, which is an unverifiable binary executable; if the source were swapped, it could lead to code execution, posing a supply-chain risk.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package installs a prebuilt .deb from a GitHub release, which is an unverifiable binary executable; if the source were swapped, it could lead to code execution, posing a supply-chain risk.

PKGBUILD

      1# Maintainer: thadah <thadahdenyse@protonmail.com>
    
      2pkgname=sable-bin
    
      3pkgver=1.0.0
    
      4pkgrel=1
    
      5pkgdesc="An almost stable Matrix client."
    
      6url="https://app.sable.moe/"
    
      7license=('AGPL-3.0-only')
    
      8arch=('x86_64')
    
      9depends=('alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'glib2' 'glibc' 'gtk4' 'gtk3' 'hicolor-icon-theme' 'libcups' 'libgcc' 'libnotify' 'libsecret' 'libx11' 'libxcb' 'libxcomposite' 'libxdamage' 'libxext' 'libxfixes' 'libxkbcommon' 'libxrandr' 'libxss' 'libxtst' 'mesa' 'nspr' 'nss' 'pango' 'systemd-libs' 'util-linux-libs' 'xdg-utils')
    
      10optdepends=('libappindicator')
    
      11options=('!strip' '!emptydirs')
    
      12provides=('sable')
    
      13conflicts=('sable')
    
      14source=("${pkgname}-${pkgver}.deb::https://github.com/7w1/sable/releases/download/${pkgver}/sable-matrix-client-electron_0.0.1_amd64.deb")
    
      15noextract=("${pkgname}-${pkgver}.deb")
    
      16sha256sums=('9be95e8771c2312b25a004bf5538db8c80774bc0ba99e11ed97bd3cd4bcfafac')
    
      17
    
      18package() {
    
      19  cd "${srcdir}"
    
      20  bsdtar -xf "${pkgname}-${pkgver}.deb" data.tar.xz
    
      21  bsdtar -xf data.tar.xz -C "${pkgdir}/"
    
      22
    
      23  # Fix icon directory which is 0x0
    
      24  install -dm755 "${pkgdir}/usr/share/icons/hicolor/512x512/apps"
    
      25  mv "${pkgdir}/usr/share/icons/hicolor/0x0/apps/sable-matrix-client-electron.png" \
    
      26    "${pkgdir}/usr/share/icons/hicolor/512x512/apps/sable-matrix-client-electron.png"
    
      27  rm -rf "${pkgdir}/usr/share/icons/hicolor/0x0"
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 01:38:17	MEDIUM	2
2026-06-18 16:11:54	CLEAN	0