shipyard-bin

MEDIUM

maintainer mmoya 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package downloads a prebuilt .deb binary from an untrusted host (GitHub releases) with a fixed checksum, but the payload is an executable that could be swapped if the release were compromised, posing a supply-chain risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package downloads a prebuilt .deb binary from an untrusted host (GitHub releases) with a fixed checksum, but the payload is an executable that could be swapped if the release were compromised, posing a supply-chain risk.

PKGBUILD

      1# Maintainer: <mmoya at mmoya dot org>
    
      2#
    
      3pkgname=shipyard-bin
    
      4pkgver=0.3.21
    
      5pkgrel=1
    
      6pkgdesc='Run coding agents on your dev boxes: worktrees, terminals, orchestration, kits and automations, with a desktop app.'
    
      7arch=('x86_64')
    
      8url='https://github.com/cosscom/shipyard'
    
      9license=('MIT')
    
      10_filename="Berth-linux-${CARCH}-alpha.deb"
    
      11source=("${url}/releases/download/v${pkgver}/${_filename}")
    
      12sha256sums=('f73f7e2cd688975bae55f5833354cbb9c19b852e0f694d6820e8825d2e55c77d')
    
      13options=('!debug')
    
      14
    
      15package() {
    
      16    ar x "${_filename}"
    
      17    tar -vxz -C "${pkgdir}" -f data.tar.gz
    
      18}
    
      19

Changes since previous scan

--- PKGBUILD @ 2026-10-13 00:23
+++ PKGBUILD @ 2026-10-17 00:21
@@ -1,7 +1,7 @@
 # Maintainer: <mmoya at mmoya dot org>
 #
 pkgname=shipyard-bin
-pkgver=0.3.16
+pkgver=0.3.21
 pkgrel=1
 pkgdesc='Run coding agents on your dev boxes: worktrees, terminals, orchestration, kits and automations, with a desktop app.'
 arch=('x86_64')
@@ -9,7 +9,7 @@
 license=('MIT')
 _filename="Berth-linux-${CARCH}-alpha.deb"
 source=("${url}/releases/download/v${pkgver}/${_filename}")
-sha256sums=('93bee791b1d0ac8afddb5559907f1e2104d2e53224e34057a62839f14030ecc3')
+sha256sums=('f73f7e2cd688975bae55f5833354cbb9c19b852e0f694d6820e8825d2e55c77d')
 options=('!debug')
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 09:11:05	Medium	2
2026-10-13 00:23:45	Clean	2
2026-10-12 21:14:41	Low	1
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 00:11:52	Low	2
2026-10-09 10:10:57	Low	2