sqlnow-desktop-bin

maintainer kindly · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package repackages official GitHub release AppImages from the project's own repository, which is a common and acceptable AUR practice; the low severity is due to the prebuilt binary nature and unverifiable origin beyond GitHub's infrastructure, but no active malicious behavior is present.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package repackages official GitHub release AppImages from the project's own repository, which is a common and acceptable AUR practice; the low severity is due to the prebuilt binary nature and unverifiable origin beyond GitHub's infrastructure, but no active malicious behavior is present.

PKGBUILD

      1# Maintainer: David Raznick <david.raznick@globalenergymonitor.org>
    
      2#
    
      3# Prebuilt-binary package, repackaging the GitHub release artifacts.
    
      4# After each release: bump pkgver, reset pkgrel, run `updpkgsums`.
    
      5#
    
      6# This is the window version. The command-line `sqlnow` is packaged separately
    
      7# as sqlnow-bin: the two are the same server and the same session store, so
    
      8# either can open a session the other left, and both can be installed at once.
    
      9#
    
      10# The app is an Electron shell around that same server, released as an
    
      11# AppImage. It is unpacked here rather than installed whole, so it needs no
    
      12# FUSE at runtime and its desktop entry and icons go where the rest of the
    
      13# system looks for them.
    
      14pkgname=sqlnow-desktop-bin
    
      15pkgver=0.4.8
    
      16pkgrel=1
    
      17pkgdesc="Local SQL viewer for files and databases, in a native window"
    
      18arch=('x86_64' 'aarch64')
    
      19url="https://github.com/kindly/sqlnow"
    
      20# taken as it was released: stripping would rewrite a file whose checksum was
    
      21# just verified, and Electron ships no split debug symbols worth keeping
    
      22options=('!strip' '!debug')
    
      23license=('MIT')
    
      24# what Electron needs; the server bundled inside carries DuckDB and the UI
    
      25depends=('gtk3' 'nss' 'alsa-lib' 'libxss' 'libnotify' 'gcc-libs' 'glibc')
    
      26optdepends=('sqlnow-bin: the command-line version, sharing the same sessions')
    
      27provides=('sqlnow-desktop')
    
      28conflicts=('sqlnow-desktop')
    
      29source_x86_64=("$pkgname-$pkgver-x86_64.AppImage::$url/releases/download/v$pkgver/sqlnow-desktop-linux-x86_64.AppImage")
    
      30source_aarch64=("$pkgname-$pkgver-aarch64.AppImage::$url/releases/download/v$pkgver/sqlnow-desktop-linux-arm64.AppImage")
    
      31sha256sums_x86_64=('dc6bb65f0ac4bd83c001dc605abe92f6ac077767bdc3a1121aca036328c73b28')
    
      32sha256sums_aarch64=('dd682fa6c587e39ef78fe5333940f802ee8d07fb24b9666f12ac356d2428861b')
    
      33
    
      34_image="$pkgname-$pkgver-$CARCH.AppImage"
    
      35
    
      36prepare() {
    
      37    chmod +x "$srcdir/$_image"
    
      38    "$srcdir/$_image" --appimage-extract > /dev/null
    
      39}
    
      40
    
      41package() {
    
      42    cd "$srcdir/squashfs-root"
    
      43
    
      44    install -d "$pkgdir/usr/lib/$pkgname"
    
      45    cp -a --no-preserve=ownership . "$pkgdir/usr/lib/$pkgname/"
    
      46
    
      47    # --appimage-extract unpacks with 0700 directories, and cp -a copies that
    
      48    # faithfully: installed as root, nothing else can even traverse them. Reset
    
      49    # to what a package should carry — readable dirs, readable files, execute
    
      50    # kept where it already was.
    
      51    chmod -R u=rwX,go=rX "$pkgdir/usr/lib/$pkgname"
    
      52    chown -R root:root "$pkgdir/usr/lib/$pkgname"
    
      53    # the AppImage's own launcher and top-level metadata are replaced below
    
      54    rm -f "$pkgdir/usr/lib/$pkgname/AppRun" \
    
      55          "$pkgdir/usr/lib/$pkgname/.DirIcon" \
    
      56          "$pkgdir/usr/lib/$pkgname/sqlnow-desktop.desktop" \
    
      57          "$pkgdir/usr/lib/$pkgname/sqlnow-desktop.png"
    
      58    rm -rf "$pkgdir/usr/lib/$pkgname/usr"
    
      59
    
      60    # Applied after the chmod above, which would clear the setuid bit.
    
      61    # Chromium uses its namespace sandbox where unprivileged user namespaces are
    
      62    # allowed, which is the case on Arch, and falls back to this helper where
    
      63    # they are not. Setuid root is what makes that fallback work, and is what
    
      64    # every Electron package here does.
    
      65    chmod 4755 "$pkgdir/usr/lib/$pkgname/chrome-sandbox"
    
      66
    
      67    install -d "$pkgdir/usr/bin"
    
      68    ln -s "/usr/lib/$pkgname/sqlnow-desktop" "$pkgdir/usr/bin/sqlnow-desktop"
    
      69
    
      70    # our own entry rather than the AppImage's, which runs AppRun --no-sandbox
    
      71    install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/sqlnow-desktop.desktop" <<'DESKTOP'
    
      72[Desktop Entry]
    
      73Type=Application
    
      74Name=sqlnow
    
      75GenericName=SQL viewer
    
      76Comment=Local SQL viewer for files and databases
    
      77Exec=sqlnow-desktop %U
    
      78Icon=sqlnow-desktop
    
      79Terminal=false
    
      80StartupNotify=true
    
      81StartupWMClass=sqlnow
    
      82Categories=Development;Database;
    
      83Keywords=SQL;DuckDB;CSV;Parquet;query;
    
      84MimeType=text/csv;application/vnd.apache.parquet;application/x-sqlite3;
    
      85DESKTOP
    
      86
    
      87    for size in 32x32 128x128; do
    
      88        install -Dm644 "usr/share/icons/hicolor/$size/apps/sqlnow-desktop.png" \
    
      89            "$pkgdir/usr/share/icons/hicolor/$size/apps/sqlnow-desktop.png"
    
      90    done
    
      91
    
      92    install -Dm644 resources/LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      93    install -Dm644 resources/README.md "$pkgdir/usr/share/doc/sqlnow-desktop/README.md"
    
      94    install -Dm644 resources/AGENTS.md "$pkgdir/usr/share/doc/sqlnow-desktop/AGENTS.md"
    
      95}
    
      96

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -12,7 +12,7 @@
 # FUSE at runtime and its desktop entry and icons go where the rest of the
 # system looks for them.
 pkgname=sqlnow-desktop-bin
-pkgver=0.4.7
+pkgver=0.4.8
 pkgrel=1
 pkgdesc="Local SQL viewer for files and databases, in a native window"
 arch=('x86_64' 'aarch64')
@@ -28,8 +28,8 @@
 conflicts=('sqlnow-desktop')
 source_x86_64=("$pkgname-$pkgver-x86_64.AppImage::$url/releases/download/v$pkgver/sqlnow-desktop-linux-x86_64.AppImage")
 source_aarch64=("$pkgname-$pkgver-aarch64.AppImage::$url/releases/download/v$pkgver/sqlnow-desktop-linux-arm64.AppImage")
-sha256sums_x86_64=('34d6ca40d0a9ad7814a8bfbc81989dcda48043291740a8378eedbda681a5dd72')
-sha256sums_aarch64=('bc1b9ab95dbd1e892012d62ae2cdddda9ba700bc19003fb981d9e82bdfb1ec7b')
+sha256sums_x86_64=('dc6bb65f0ac4bd83c001dc605abe92f6ac077767bdc3a1121aca036328c73b28')
+sha256sums_aarch64=('dd682fa6c587e39ef78fe5333940f802ee8d07fb24b9666f12ac356d2428861b')
 
 _image="$pkgname-$pkgver-$CARCH.AppImage"
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 15:18:17	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 09:11:06	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 23:36:42	LOW	2
2026-07-27 01:34:00	LOW	2
2026-07-27 00:24:32	CLEAN	2
2026-07-26 23:33:54	LOW	1
2026-07-26 19:33:02	LOW	1
2026-07-26 15:32:35	LOW	1