sable-next-bin

MEDIUM

maintainer Thadah 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

Prebuilt binary .deb downloaded from a self-hosted Gitea instance (git.sable.moe) that is plausibly the project's own infrastructure, but is not an established/verifiable vendor domain; the binary is executed at install time and cannot be independently verified beyond the provided checksum, making it a moderate supply-chain risk if the host were compromised or swapped.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("${pkgname}-${pkgver}.deb::https://git.sable.moe/SableClient/sable-next/releases/download/v${pkgver}/sable-${pkgver}-linux-x86_64.deb")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Prebuilt binary .deb downloaded from a self-hosted Gitea instance (git.sable.moe) that is plausibly the project's own infrastructure, but is not an established/verifiable vendor domain; the binary is executed at install time and cannot be independently verified beyond the provided checksum, making it a moderate supply-chain risk if the host were compromised or swapped.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: thadah <thadahdenyse@protonmail.com>
    
      2pkgname=sable-next-bin
    
      3pkgver=2.0.2
    
      4pkgrel=1
    
      5pkgdesc="Sable rewrite in Rust and Svelte"
    
      6url=" https://next.sable.moe"
    
      7license=('AGPL-3.0-or-later')
    
      8arch=('x86_64')
    
      9depends=(
    
      10  'alsa-lib'
    
      11  'gtk3'
    
      12  'libcups'
    
      13  'libpipewire'
    
      14  'libxkbcommon'
    
      15  'mesa'
    
      16  'nspr'
    
      17  'nss'
    
      18)
    
      19options=(!debug)
    
      20provides=('sable-next')
    
      21conflicts=('sable-next')
    
      22source=("${pkgname}-${pkgver}.deb::https://git.sable.moe/SableClient/sable-next/releases/download/v${pkgver}/sable-${pkgver}-linux-x86_64.deb")
    
      23sha256sums=('e7e52b457844fdb44bef058aa60e6458589f4389dc0a0d8315fdc14c8f42189b')
    
      24
    
      25package() {
    
      26  bsdtar -xf "${pkgname}-${pkgver}.deb" data.tar.gz
    
      27  bsdtar -xf data.tar.gz -C "${pkgdir}/"
    
      28
    
      29  # Install license
    
      30  install -Dm644 "${pkgdir}/opt/sable-next/CEF-LICENSE.txt" "${pkgdir}/usr/share/licenses/${pkgname}/CEF-LICENSE.txt"
    
      31}
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	3
2026-10-16 00:12:47	Medium	3
2026-10-15 00:28:05	Medium	3
2026-10-14 00:06:47	Medium	3
2026-10-13 09:18:16	Medium	3
2026-10-13 09:16:20	Medium	3