secure-vault-linuxfs-bin
maintainer Code1Support
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package installs a prebuilt binary from a public GitHub release, which is a normal practice for freeware-distributed software; the source is verifiable via pinned checksum and the binary is not executed during build, posing no active supply-chain risk beyond typical -bin packages.
Triggered rules
LOW
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
LOW
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from a public GitHub release, which is a normal practice for freeware-distributed software; the source is verifiable via pinned checksum and the binary is not executed during build, posing no active supply-chain risk beyond typical -bin packages.
PKGBUILD
1
# Maintainer: Xue Dong <support@code1one.com>
2
#
3
# AUR `-bin` package for the secure-vault Linux FUSE daemon.
4
#
5
# Ships the PREBUILT x86_64 binary from a GitHub Release in the PUBLIC releases
6
# repo — no Rust toolchain, no build of `core`, no `core` .so. This is the
7
# freeware-distributable package (docs/licensing.md §9): the daemon binary is
8
# licensed under the LinuxFS freeware EULA (docs/eula-linuxfs.md — gratis,
9
# redistribute-unmodified), while `core` and the iOS app stay closed.
10
#
11
# Hosting (docs/licensing.md §9.3): the closed source lives only in the private
12
# repo; CI on a self-hosted Arch runner builds the binary and publishes ONLY the
13
# compiled tarball to the public `secure-vault-linuxfs-releases` repo. `source=`
14
# below points at that public release — no source ever reaches the public repo.
15
16
pkgname=secure-vault-linuxfs-bin
17
pkgver=0.1.0
18
pkgrel=1
19
pkgdesc="secure-vault encrypted-vault FUSE daemon (rclone-crypt compatible, Google Drive backend) — prebuilt binary"
20
arch=('x86_64')
21
url="https://github.com/GreyWizardPublic/secure-vault"
22
# Freeware EULA (docs/eula-linuxfs.md), shipped as the package LICENSE.
23
license=('custom')
24
# Runtime deps (docs/licensing.md §9.2), depended upon in two different ways:
25
# openssl — real dynamic LINK dep: libssl.so.3/libcrypto.so.3, pulled in via
26
# core -> reqwest -> native-tls. Shows up in `ldd`.
27
# fuse3 — NOT linked. fuser 0.17 speaks the FUSE protocol over /dev/fuse in
28
# pure Rust and EXECS the setuid /usr/bin/fusermount3 helper (from
29
# this package) to mount. Invisible to `ldd`, but required at run
30
# time. Because libfuse3 is exec'd as a separate program rather than
31
# linked, the binary carries no LGPL dynamic-linking obligation.
32
# `linuxfs-smoke.yml` asserts both facts on every build.
33
# SQLite & ring are static.
34
depends=('fuse3' 'openssl')
35
provides=('secure-vault-linuxfs')
36
conflicts=('secure-vault-linuxfs')
37
install="${pkgname}.install"
38
options=('!strip' '!debug') # release binary is already stripped by CI
39
40
_stage="secure-vault-linuxfs-${pkgver}-x86_64"
41
_releases="https://github.com/GreyWizardPublic/secure-vault-linuxfs-releases"
42
source=("${_releases}/releases/download/linuxfs-v${pkgver}/${_stage}.tar.gz")
43
44
# Pinned by `linuxfs/packaging/ci/release.sh`, which rewrites this line with the
45
# digest of the tarball it just published. A published -bin package MUST pin a
46
# real checksum: 'SKIP' would let a substituted tarball install silently. The
47
# release script refuses to push a PKGBUILD still carrying the placeholder.
48
sha256sums=('36c4d6c8759cc2c06adb9fa4d23b7d031268fb338b2c97357ebfcef009b9ef1f')
49
50
package() {
51
cd "$srcdir/$_stage"
52
53
install -Dm755 secure-vault-linuxfs \
54
"$pkgdir/usr/bin/secure-vault-linuxfs"
55
56
install -Dm644 secure-vault@.service \
57
"$pkgdir/usr/lib/systemd/system/secure-vault@.service"
58
install -Dm644 secure-vault.sysusers \
59
"$pkgdir/usr/lib/sysusers.d/secure-vault.conf"
60
install -Dm644 secure-vault.tmpfiles \
61
"$pkgdir/usr/lib/tmpfiles.d/secure-vault.conf"
62
63
install -Dm644 README.md \
64
"$pkgdir/usr/share/doc/$pkgname/README.md"
65
install -Dm644 examples/local-vault.toml \
66
"$pkgdir/usr/share/doc/$pkgname/examples/local-vault.toml"
67
install -Dm644 examples/drive-vault.toml \
68
"$pkgdir/usr/share/doc/$pkgname/examples/drive-vault.toml"
69
70
# Licenses (docs/licensing.md §9.3): freeware EULA is the governing LICENSE;
71
# COPYRIGHT names the holder; THIRD_PARTY_NOTICES.md carries the full-text
72
# permissive-crate attributions required for binary redistribution (§9.2).
73
install -Dm644 EULA.txt \
74
"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
75
install -Dm644 COPYRIGHT \
76
"$pkgdir/usr/share/licenses/$pkgname/COPYRIGHT"
77
install -Dm644 THIRD_PARTY_NOTICES.md \
78
"$pkgdir/usr/share/licenses/$pkgname/THIRD_PARTY_NOTICES.md"
79
}
80
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 01:22:21 | LOW | 2 |