sindricad-beta
MEDIUM
maintainer dcelasun
0 votes
scanned 2026-09-25 00:03:36.779685
Why flagged
The package installs an unverifiable prebuilt binary (DEB) from a GitHub release, which could be silently swapped if the source is compromised, posing a supply-chain risk despite the project being legitimate.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Medium
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs an unverifiable prebuilt binary (DEB) from a GitHub release, which could be silently swapped if the source is compromised, posing a supply-chain risk despite the project being legitimate.
PKGBUILD
1
# Maintainer: D. Can Celasun <can[at]dcc[dot]im>
2
3
pkgname=sindricad-beta
4
_pkgname=sindricad
5
pkgver=0.1.227
6
pkgrel=1
7
pkgdesc="Parametric CAD for 3D printing (rolling beta, official binary)"
8
arch=('x86_64')
9
url="https://github.com/MakerViking/sindricad"
10
license=('AGPL-3.0-only')
11
# Bundles its own Python runtime and prebuilt wheels,
12
# stripping breaks the bundled shared objects.
13
options=(!strip)
14
depends=('glibc' 'gtk3' 'webkit2gtk-4.1')
15
provides=("${_pkgname}")
16
conflicts=("${_pkgname}")
17
install=${pkgname}.install
18
source=("${pkgname}-${pkgver}.deb::${url}/releases/download/beta/SindriCAD_${pkgver}_amd64.deb")
19
sha256sums=('8002180604553ada2b2b87432a8a01bb75b6f49f0a775a8fed6b1444c6503da0')
20
21
package() {
22
bsdtar -xf data.tar.* -C "${pkgdir}/"
23
24
# Fix icon directory
25
mv "${pkgdir}/usr/share/icons/hicolor/256x256@2" "${pkgdir}/usr/share/icons/hicolor/256x256"
26
}
27
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-25 00:03:36 | Medium | 2 |
| 2026-09-24 23:44:46 | Medium | 2 |
| 2026-09-24 17:43:55 | Medium | 2 |