shift-editor-bin

MEDIUM

maintainer shbernal 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package installs a prebuilt .deb binary from a GitHub release without source availability, creating an unverifiable supply-chain risk despite the project being plausibly legitimate.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt .deb binary from a GitHub release without source availability, creating an unverifiable supply-chain risk despite the project being plausibly legitimate.

PKGBUILD

      1# Maintainer: shbernal <shbernal.01@gmail.com>
    
      2
    
      3_repo=shift
    
      4_user=shift-editor
    
      5_appname=Shift
    
      6pkgname=${_user}-bin
    
      7pkgver=0.1.1
    
      8pkgrel=1
    
      9pkgdesc='A cross-platform font editor built in Rust and TypeScript'
    
      10arch=('x86_64')
    
      11url="https://github.com/${_user}/${_repo}"
    
      12license=('MIT OR Apache-2.0')
    
      13depends=(
    
      14  'alsa-lib'
    
      15  'at-spi2-core'
    
      16  'cairo'
    
      17  'dbus'
    
      18  'expat'
    
      19  'glib2'
    
      20  'glibc'
    
      21  'gtk3'
    
      22  'libcups'
    
      23  'libgcc'
    
      24  'libx11'
    
      25  'libxcb'
    
      26  'libxcomposite'
    
      27  'libxdamage'
    
      28  'libxext'
    
      29  'libxfixes'
    
      30  'libxkbcommon'
    
      31  'libxrandr'
    
      32  'mesa'
    
      33  'nspr'
    
      34  'nss'
    
      35  'pango'
    
      36  'sqlite'
    
      37  'systemd-libs'
    
      38  'xdg-utils'
    
      39)
    
      40optdepends=('libsecret: store credentials in the system keyring')
    
      41provides=("${_user}")
    
      42conflicts=("${_user}")
    
      43options=('!strip' '!debug')
    
      44
    
      45_deb="${_appname}-${pkgver}-Linux-x64.deb"
    
      46source=("${_deb}::${url}/releases/download/v${pkgver}/${_deb}")
    
      47noextract=("${_deb}")
    
      48sha256sums=('051ad355ab274b614bd065e6865619db8e59603c2d741fe919e9da803a79aff2')
    
      49
    
      50prepare() {
    
      51  mkdir -p deb
    
      52  bsdtar -xOf "${_deb}" data.tar.xz | bsdtar -xf - -C deb
    
      53}
    
      54
    
      55package() {
    
      56  cp -a deb/. "${pkgdir}/"
    
      57
    
      58  # APT repository config and the Debian changelog don't belong on Arch
    
      59  rm -rf "${pkgdir}/etc" "${pkgdir}/usr/share/doc"
    
      60
    
      61  # Arch has unprivileged user namespaces, so the sandbox helper needs no SUID
    
      62  chmod 755 "${pkgdir}/opt/${_appname}/chrome-sandbox"
    
      63
    
      64  # /usr/bin/shift is too generic a name; expose the app as shift-editor
    
      65  install -dm755 "${pkgdir}/usr/bin"
    
      66  ln -s "/opt/${_appname}/shift" "${pkgdir}/usr/bin/${_user}"
    
      67  sed -i "s|^Exec=.*|Exec=${_user} %U|" "${pkgdir}/usr/share/applications/shift.desktop"
    
      68
    
      69  install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}"
    
      70  ln -s "/opt/${_appname}/resources/LICENSE-MIT" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE-MIT"
    
      71  ln -s "/opt/${_appname}/resources/LICENSE-APACHE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE-APACHE"
    
      72}
    
      73

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	2
2026-10-16 09:15:55	Medium	2