skykeep-bin

MEDIUM

maintainer Felitendo 0 votes scanned 2026-11-05 22:10:45.226294

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release without a verifiable build process, posing a supply-chain risk if the source is compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The package installs a prebuilt binary from a GitHub release without a verifiable build process, posing a supply-chain risk if the source is compromised.

PKGBUILD

      1# Maintainer: Felitendo
    
      2# This PKGBUILD is updated automatically:
    
      3# https://github.com/Felitendo/PKGBUILDS
    
      4
    
      5pkgname=skykeep-bin
    
      6pkgver=0.1.6
    
      7pkgrel=1
    
      8pkgdesc="Native iCloud apps: Notes, Reminders, Calendar, Contacts, Drive and Photos, offline and in sync (upstream binary)"
    
      9arch=('x86_64')
    
      10url="https://github.com/YashwanthKamireddi/Skykeep"
    
      11license=('GPL-3.0-only')
    
      12# What the binary links (readelf -d), plus the GStreamer plugins it loads for
    
      13# videos: base and good for the elements, libav for H.264 and HEVC.
    
      14depends=('cairo' 'dbus' 'gdk-pixbuf2' 'glib2' 'glibc' 'gst-libav'
    
      15         'gst-plugins-base' 'gst-plugins-base-libs' 'gst-plugins-good' 'gstreamer'
    
      16         'gtk3' 'hicolor-icon-theme' 'libgcc' 'libheif' 'libsoup3' 'webkit2gtk-4.1')
    
      17# The keyring is spoken to over D-Bus, so it needs a Secret Service, not libsecret.
    
      18optdepends=('org.freedesktop.secrets: stay signed in'
    
      19            'fuse3: iCloud Drive and Photos as folders in the file manager')
    
      20provides=('skykeep')
    
      21conflicts=('skykeep')
    
      22options=('!strip' '!debug')
    
      23source=("${pkgname}-${pkgver}.deb::${url}/releases/download/v${pkgver}/Skykeep_${pkgver}_amd64.deb")
    
      24noextract=("${pkgname}-${pkgver}.deb")
    
      25sha256sums=('0091c4785cf6cc3dd985800c6a974f29b3309cea6ca312171c0adccafb70662c')
    
      26
    
      27package() {
    
      28  bsdtar -xOf "$srcdir/${pkgname}-${pkgver}.deb" 'data.tar.*' \
    
      29    | bsdtar -xpf - -C "$pkgdir" ./usr
    
      30
    
      31  # no icon theme reads this folder, the 512px icon covers it
    
      32  rm -r "$pkgdir/usr/share/icons/hicolor/256x256@2"
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-05 22:10:45	Medium	2