sing-box-ez-gui-bin

MEDIUM

maintainer he11ah0und 0 votes scanned 2026-11-03 10:04:25.157601

View on AUR

Why flagged

Installs a prebuilt binary from a GitHub release with unverifiable checksums (SKIP), posing a supply-chain risk if the source were swapped.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): Installs a prebuilt binary from a GitHub release with unverifiable checksums (SKIP), posing a supply-chain risk if the source were swapped.

PKGBUILD

      1# Maintainer: he11ah0und
    
      2#
    
      3# Binary (-bin) package: installs the prebuilt GUI binary produced by the
    
      4# release CI, so no Go/npm/Wails toolchain is needed at build time.
    
      5# The CLI package is intentionally not published yet (GUI-only release).
    
      6#
    
      7# Before publishing: pick a real license (the repo ships no LICENSE file).
    
      8pkgname=sing-box-ez-gui-bin
    
      9pkgver=0.1.0
    
      10pkgrel=1
    
      11pkgdesc="GUI client for the sing-box proxy core (prebuilt binary)"
    
      12arch=('x86_64')
    
      13url="https://github.com/he11ah0und/sing-box-ez"
    
      14license=('GPL3')
    
      15depends=('webkitgtk-6.0' 'gtk4')
    
      16provides=('sing-box-ez-gui' 'sing-box-ez')
    
      17conflicts=('sing-box-ez-gui' 'sing-box-ez')
    
      18source=("$pkgname-$pkgver::https://github.com/he11ah0und/sing-box-ez/releases/download/v$pkgver/sing-box-ez-amd64-linux-gcc-gui"
    
      19        "sing-box-ez.desktop"
    
      20        "appicon.png")
    
      21# The first entry is refreshed by the publish workflow on every release.
    
      22sha256sums=('f0cfcaecc8674c216df75a5e3c39cf90a7b2d26de6499f38d5f14ffc3e790d2b' 'SKIP' 'SKIP')
    
      23
    
      24package() {
    
      25  install -Dm755 "$srcdir/$pkgname-$pkgver" "$pkgdir/usr/bin/sing-box-ez"
    
      26  install -Dm644 "$srcdir/sing-box-ez.desktop" "$pkgdir/usr/share/applications/sing-box-ez.desktop"
    
      27  install -Dm644 "$srcdir/appicon.png" "$pkgdir/usr/share/pixmaps/sing-box-ez.png"
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-03 10:04:25	Medium	2