sharkfin-keyboard-bin

maintainer dnim · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs a prebuilt binary from a GitHub release, which is a supply-chain risk if the host is compromised, but it is the project's official release infrastructure and the binary is not executed during build; realistic impact is limited to code execution only when the user runs the software.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from a GitHub release, which is a supply-chain risk if the host is compromised, but it is the project's official release infrastructure and the binary is not executed during build; realistic impact is limited to code execution only when the user runs the software.

PKGBUILD

      1# Maintainer: JR Lanteigne <root at dnim dot dev>
    
      2# SPDX-FileCopyrightText: JR Lanteigne <root@dnim.dev>
    
      3# SPDX-License-Identifier: GPL-3.0-or-later
    
      4
    
      5# pkgver and the checksums below are set from the git tag by the `aur` job
    
      6# in .github/workflows/release.yml, which is what publishes this. The values
    
      7# committed here are the last published ones, kept so the file still builds
    
      8# by hand.
    
      9pkgname=sharkfin-keyboard-bin
    
      10_pkgname=sharkfin
    
      11pkgver=0.1.11
    
      12pkgrel=2
    
      13pkgdesc='Configurator for Attack Shark and other ROYUAN keyboards'
    
      14arch=('x86_64')
    
      15url='https://github.com/dniminenn/sharkfin'
    
      16license=('GPL-3.0-or-later')
    
      17depends=('cairo' 'dbus' 'gdk-pixbuf2' 'glib2' 'glibc' 'gtk3' 'hicolor-icon-theme' 'libgcc'
    
      18         'libsoup3' 'systemd-libs' 'webkit2gtk-4.1')
    
      19provides=('sharkfin-keyboard')
    
      20# The AUR package named sharkfin is an unrelated project that also installs
    
      21# /usr/bin/sharkfin.
    
      22conflicts=('sharkfin-keyboard' 'sharkfin')
    
      23# The .deb carries no debug info, so a debug package would be an empty
    
      24# directory plus a dangling symlink. Letting makepkg strip the binary as usual
    
      25# is what keeps namcap quiet; !strip would trade one warning for another.
    
      26options=('!debug')
    
      27source_x86_64=("$url/releases/download/v$pkgver/${_pkgname}_${pkgver}_amd64.deb")
    
      28b2sums_x86_64=('5df6d10d8de018f289facf5cd4e7514f2b7fcfa53a3f334dd4b064b5486007a1012bb6e7a09646837d5623941cbe3b871ea99d06c249f15fe0390600e535df9e')
    
      29
    
      30package() {
    
      31  bsdtar -O -xf "${_pkgname}_${pkgver}_amd64.deb" data.tar.gz \
    
      32    | bsdtar -xzf - -C "$pkgdir" usr
    
      33}
    
      34

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,10 +2,14 @@
 # SPDX-FileCopyrightText: JR Lanteigne <root@dnim.dev>
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+# pkgver and the checksums below are set from the git tag by the `aur` job
+# in .github/workflows/release.yml, which is what publishes this. The values
+# committed here are the last published ones, kept so the file still builds
+# by hand.
 pkgname=sharkfin-keyboard-bin
 _pkgname=sharkfin
-pkgver=0.1.8
-pkgrel=1
+pkgver=0.1.11
+pkgrel=2
 pkgdesc='Configurator for Attack Shark and other ROYUAN keyboards'
 arch=('x86_64')
 url='https://github.com/dniminenn/sharkfin'
@@ -16,8 +20,12 @@
 # The AUR package named sharkfin is an unrelated project that also installs
 # /usr/bin/sharkfin.
 conflicts=('sharkfin-keyboard' 'sharkfin')
+# The .deb carries no debug info, so a debug package would be an empty
+# directory plus a dangling symlink. Letting makepkg strip the binary as usual
+# is what keeps namcap quiet; !strip would trade one warning for another.
+options=('!debug')
 source_x86_64=("$url/releases/download/v$pkgver/${_pkgname}_${pkgver}_amd64.deb")
-b2sums_x86_64=('8e3d85243e154af8c8c1dbe1dee05c8ae08a7d83807ade7e3140267e575ef190822a1df2195b32540ce6d2e46a75fe562552289308bc92ddfb40884c99e16d14')
+b2sums_x86_64=('5df6d10d8de018f289facf5cd4e7514f2b7fcfa53a3f334dd4b064b5486007a1012bb6e7a09646837d5623941cbe3b871ea99d06c249f15fe0390600e535df9e')
 
 package() {
   bsdtar -O -xf "${_pkgname}_${pkgver}_amd64.deb" data.tar.gz \

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 05:17:13	LOW	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 23:13:22	MEDIUM	2