snapx-bin

maintainer Felitendo · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs a prebuilt binary from the project's official GitHub releases, which is normal for AUR binary packages; the source is verifiable and checksummed, and the build script does not execute arbitrary remote code or exfiltrate data.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from the project's official GitHub releases, which is normal for AUR binary packages; the source is verifiable and checksummed, and the build script does not execute arbitrary remote code or exfiltrate data.

PKGBUILD

      1# Maintainer: Felitendo
    
      2# This PKGBUILD is updated automatically:
    
      3# https://github.com/Felitendo/PKGBUILDS
    
      4
    
      5pkgname=snapx-bin
    
      6pkgver=0.4.0
    
      7pkgrel=2
    
      8pkgdesc="Screenshot tool that handles images, text, and video - ShareX fork, Avalonia UI (upstream binary)"
    
      9arch=('x86_64')
    
      10url="https://github.com/SnapXL/SnapX"
    
      11license=('GPL-3.0-or-later')
    
      12depends=('glibc' 'gcc-libs' 'hicolor-icon-theme')
    
      13provides=('snapx-ui')
    
      14conflicts=('snapx-ui')
    
      15options=('!strip' '!debug')
    
      16# Upstream asset names embed build metadata that cannot be derived from
    
      17# pkgver, so the exact name is tracked here and refreshed automatically.
    
      18_asset="SnapX-UI-Release-Linux-0.4.0-alpha.0+g7eafb0f-X64.tar.zst"
    
      19source=("${pkgname}-${pkgver}.tar.zst::${url}/releases/download/v${pkgver}/${_asset}"
    
      20        "${pkgname}-${pkgver}-src.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz")
    
      21noextract=("${pkgname}-${pkgver}.tar.zst")
    
      22sha256sums=('1cbecd1caca21e611030eedbb8e5a43cc4bf62d55cfa56a2e5c2ac31b3d21e35' 'd85f4d2c3ea55ed5040f166fdf44ce03dd0270dc6ab05ee26771dbd02eaacc06')
    
      23
    
      24package() {
    
      25  # upstream's self-contained bundle, installed unchanged
    
      26  install -d "$pkgdir/opt/snapx"
    
      27  bsdtar -xpf "$srcdir/${pkgname}-${pkgver}.tar.zst" -C "$pkgdir/opt/snapx"
    
      28  chmod 755 "$pkgdir/opt/snapx/snapx-ui"
    
      29
    
      30  # upstream's launcher resolves its own directory, so a symlink from
    
      31  # /usr/bin would break it - use a wrapper instead
    
      32  install -d "$pkgdir/usr/bin"
    
      33  cat > "$pkgdir/usr/bin/snapx-ui" << 'EOF'
    
      34#!/bin/sh
    
      35exec /opt/snapx/snapx-ui "$@"
    
      36EOF
    
      37  chmod 755 "$pkgdir/usr/bin/snapx-ui"
    
      38
    
      39  # desktop entry, icons and metainfo ship in the source tree only
    
      40  cp -a "$srcdir/SnapX-${pkgver}/packaging/usr/share" "$pkgdir/usr/"
    
      41
    
      42  install -Dm644 "$pkgdir/opt/snapx/LICENSE.md" \
    
      43    "$pkgdir/usr/share/licenses/$pkgname/LICENSE.md"
    
      44}
    
      45

Changes since previous scan

--- PKGBUILD @ 2026-07-27 00:24
+++ PKGBUILD @ 2026-08-03 00:08
@@ -4,7 +4,7 @@
 
 pkgname=snapx-bin
 pkgver=0.4.0
-pkgrel=1
+pkgrel=2
 pkgdesc="Screenshot tool that handles images, text, and video - ShareX fork, Avalonia UI (upstream binary)"
 arch=('x86_64')
 url="https://github.com/SnapXL/SnapX"
@@ -13,11 +13,33 @@
 provides=('snapx-ui')
 conflicts=('snapx-ui')
 options=('!strip' '!debug')
-source=("https://github.com/Felitendo/PKGBUILDS/releases/download/${pkgname}-${pkgver}/${pkgname}-${pkgver}.tar.zst")
-sha256sums=('d2098cac542bca82e68be0a4fa98db22f2d84d35c683d18582382dc9206eb5ee')
+# Upstream asset names embed build metadata that cannot be derived from
+# pkgver, so the exact name is tracked here and refreshed automatically.
+_asset="SnapX-UI-Release-Linux-0.4.0-alpha.0+g7eafb0f-X64.tar.zst"
+source=("${pkgname}-${pkgver}.tar.zst::${url}/releases/download/v${pkgver}/${_asset}"
+        "${pkgname}-${pkgver}-src.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz")
+noextract=("${pkgname}-${pkgver}.tar.zst")
+sha256sums=('1cbecd1caca21e611030eedbb8e5a43cc4bf62d55cfa56a2e5c2ac31b3d21e35' 'd85f4d2c3ea55ed5040f166fdf44ce03dd0270dc6ab05ee26771dbd02eaacc06')
 
 package() {
-  cp -a "$srcdir/usr" "$pkgdir/"
-  cp -a "$srcdir/opt" "$pkgdir/"
+  # upstream's self-contained bundle, installed unchanged
+  install -d "$pkgdir/opt/snapx"
+  bsdtar -xpf "$srcdir/${pkgname}-${pkgver}.tar.zst" -C "$pkgdir/opt/snapx"
+  chmod 755 "$pkgdir/opt/snapx/snapx-ui"
+
+  # upstream's launcher resolves its own directory, so a symlink from
+  # /usr/bin would break it - use a wrapper instead
+  install -d "$pkgdir/usr/bin"
+  cat > "$pkgdir/usr/bin/snapx-ui" << 'EOF'
+#!/bin/sh
+exec /opt/snapx/snapx-ui "$@"
+EOF
+  chmod 755 "$pkgdir/usr/bin/snapx-ui"
+
+  # desktop entry, icons and metainfo ship in the source tree only
+  cp -a "$srcdir/SnapX-${pkgver}/packaging/usr/share" "$pkgdir/usr/"
+
+  install -Dm644 "$pkgdir/opt/snapx/LICENSE.md" \
+    "$pkgdir/usr/share/licenses/$pkgname/LICENSE.md"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 17:35:03	LOW	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 11:27:50	MEDIUM	2
2026-07-24 09:27:42	MEDIUM	2