signboard-appimage

maintainer Cleboost · 1 votes · scanned 2026-08-18 00:03:42.021799

MEDIUM

Why flagged The package installs a prebuilt AppImage from the project's official GitHub releases, which is executable code that cannot be independently verified, creating a supply-chain risk if the source were compromised.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt AppImage from the project's official GitHub releases, which is executable code that cannot be independently verified, creating a supply-chain risk if the source were compromised.

PKGBUILD

      1# Maintainer: Cleboost <clement.balarot@gmail.com>
    
      2# Contributor: missing-aur project <https://github.com/Cleboost/missing-aur>
    
      3
    
      4pkgname=signboard-appimage
    
      5pkgver=1.6.0
    
      6pkgrel=1
    
      7pkgdesc="A local-first kanban app that writes Markdown files (AppImage)"
    
      8url="https://github.com/cdevroe/signboard"
    
      9arch=("x86_64" "aarch64")
    
      10depends=("fuse2")
    
      11options=("!strip")
    
      12license=("MIT")
    
      13
    
      14source_x86_64=("signboard-appimage-${pkgver}-x86_64.AppImage::${url}/releases/download/${pkgver}/signboard_${pkgver}_linux_x86_64.AppImage" "signboard.png::https://raw.githubusercontent.com/cdevroe/signboard/main/build/icons/512x512.png" "signboard.desktop::https://raw.githubusercontent.com/Cleboost/missing-aur/main/packages/signboard/signboard.desktop")
    
      15source_aarch64=("signboard-appimage-${pkgver}-aarch64.AppImage::${url}/releases/download/${pkgver}/signboard_${pkgver}_linux_arm64.AppImage" "signboard.png::https://raw.githubusercontent.com/cdevroe/signboard/main/build/icons/512x512.png" "signboard.desktop::https://raw.githubusercontent.com/Cleboost/missing-aur/main/packages/signboard/signboard.desktop")
    
      16sha256sums_x86_64=('d2ff89c11c4ebdb4d5d489ea5783e59cf2b2ff0b70bfaf7154a525333d2a6820'
    
      17                   '798a7a47642b751b600bf50f20badf41eec6280b90fd1e16fb3924537f7c1836'
    
      18                   'c9c504cabbf47ad1c214d605890777be8399fef4f669c36d31b7e57a82dd9873')
    
      19sha256sums_aarch64=('83746c8a2d11ee23aac27b50497d68d0a318bd1c194c0b920504ffe2873bcfc4'
    
      20                    '798a7a47642b751b600bf50f20badf41eec6280b90fd1e16fb3924537f7c1836'
    
      21                    'c9c504cabbf47ad1c214d605890777be8399fef4f669c36d31b7e57a82dd9873')
    
      22
    
      23prepare() {
    
      24  if [ "${CARCH}" = "x86_64" ]; then
    
      25    chmod +x "${srcdir}/signboard-appimage-${pkgver}-x86_64.AppImage"
    
      26  elif [ "${CARCH}" = "aarch64" ]; then
    
      27    chmod +x "${srcdir}/signboard-appimage-${pkgver}-aarch64.AppImage"
    
      28  fi
    
      29}
    
      30
    
      31package() {
    
      32  if [ "${CARCH}" = "x86_64" ]; then
    
      33    install -Dm755 "${srcdir}/signboard-appimage-${pkgver}-x86_64.AppImage" "${pkgdir}/opt/signboard-appimage/signboard.AppImage"
    
      34  elif [ "${CARCH}" = "aarch64" ]; then
    
      35    install -Dm755 "${srcdir}/signboard-appimage-${pkgver}-aarch64.AppImage" "${pkgdir}/opt/signboard-appimage/signboard.AppImage"
    
      36  fi
    
      37  install -dm755 "${pkgdir}/usr/bin"
    
      38  ln -sf "/opt/signboard-appimage/signboard.AppImage" "${pkgdir}/usr/bin/signboard"
    
      39  install -Dm644 "${srcdir}/signboard.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/signboard.png"
    
      40  install -Dm644 "${srcdir}/signboard.desktop" "${pkgdir}/usr/share/applications/signboard.desktop"
    
      41}
    
      42
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	MEDIUM	2
2026-08-17 00:18:29	MEDIUM	2
2026-08-16 00:03:42	MEDIUM	2
2026-08-15 00:26:13	MEDIUM	2
2026-08-14 00:03:41	MEDIUM	2
2026-08-13 00:17:07	MEDIUM	2
2026-08-12 13:23:33	MEDIUM	2