shandianshuo

MEDIUM

maintainer Sighthesia 0 votes scanned 2026-09-22 09:37:47.929419

View on AUR

Why flagged

Installs a prebuilt .deb from GitHub releases without source build, creating a supply-chain risk if the release artifact is swapped.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): Installs a prebuilt .deb from GitHub releases without source build, creating a supply-chain risk if the release artifact is swapped.

PKGBUILD

      1# Maintainer: tanwei <contact@tanwei.co>
    
      2# Contributor: Shandianshuo
    
      3
    
      4pkgname=shandianshuo
    
      5pkgver=0.7.8beta.1
    
      6pkgrel=1
    
      7pkgdesc="AI voice dictation and communication assistant (闪电说)"
    
      8url="https://shandianshuo.cn"
    
      9license=("custom")
    
      10arch=("x86_64")
    
      11depends=(
    
      12  "alsa-lib"
    
      13  "cairo"
    
      14  "dbus"
    
      15  "gdk-pixbuf2"
    
      16  "glib2"
    
      17  "glibc"
    
      18  "gstreamer"
    
      19  "gtk3"
    
      20  "gtk-layer-shell"
    
      21  "hicolor-icon-theme"
    
      22  "libayatana-appindicator"
    
      23  "libevdev"
    
      24  "libgcc"
    
      25  "libsoup3"
    
      26  "libstdc++"
    
      27  "libx11"
    
      28  "libxcb"
    
      29  "webkit2gtk-4.1"
    
      30  "wl-clipboard"
    
      31  "wtype"
    
      32  "xclip"
    
      33  "xdg-utils"
    
      34  "xdotool"
    
      35)
    
      36options+=("!strip" "!debug")
    
      37source=("$pkgname-$pkgver.deb::https://github.com/shandianshuo/shandianshuo-releases/releases/download/v0.7.8-beta.1/shandianshuo_0.7.8-beta.1_amd64.deb")
    
      38sha256sums=('65df81535db2799fe57ecb28561efd5aebd97e296e41fefdd1e3c43a31b8b620')
    
      39install="$pkgname.install"
    
      40
    
      41package() {
    
      42  # Extract the .deb
    
      43  local deb_extract="$srcdir/deb-extract"
    
      44  mkdir -p "$deb_extract"
    
      45  ar x "$srcdir/$pkgname-$pkgver.deb" -C "$deb_extract"
    
      46
    
      47  # Extract data.tar.gz
    
      48  tar -xzf "$deb_extract/data.tar.gz" -C "$pkgdir"
    
      49
    
      50  # Ensure proper permissions
    
      51  chmod +x "$pkgdir/usr/bin/shandianshuo"
    
      52  chmod +x "$pkgdir/usr/share/shandianshuo/scripts/setup-input-permission.sh"
    
      53}
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-22 09:37:47	Medium	2