stank-bin

maintainer anetavitek · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt binaries from GitHub releases, which is a common but unverifiable practice; however, the source is the project's official repository and the binaries are checksummed, limiting risk to typical supply-chain concerns for binary packages.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from GitHub releases, which is a common but unverifiable practice; however, the source is the project's official repository and the binaries are checksummed, limiting risk to typical supply-chain concerns for binary packages.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      2
    
      3_pkgauthor=mcandre
    
      4_pkgname=stank
    
      5_pkgexecs=(stank stink funk)
    
      6pkgname=${_pkgname}-bin
    
      7pkgver=0.0.41
    
      8pkgrel=1
    
      9_pkgvername=v${pkgver}
    
      10pkgdesc="Analyzers for determining whether files smell like rotten POSIX shell scripts, or faintly rosy like Ruby and Python scripts"
    
      11arch=('x86_64' 'i686' 'aarch64')
    
      12_barch=('amd64' '386' 'arm64')
    
      13url="https://github.com/${_pkgauthor}/${_pkgname}"
    
      14_urlraw="https://raw.githubusercontent.com/${_pkgauthor}/${_pkgname}/${_pkgvername}"
    
      15license=('BSD-2-Clause')
    
      16
    
      17conflicts=("${_pkgname}"{,-git})
    
      18provides=("${_pkgexecs[@]}")
    
      19
    
      20source=("${_pkgname}-${pkgver}.tgz::${url}/releases/download/${_pkgvername}/${_pkgname}-${pkgver}.tgz"
    
      21        "README-${pkgver}.md::${_urlraw}/README.md"
    
      22        "LICENSE-${pkgver}::${_urlraw}/LICENSE.md")
    
      23sha256sums=('96b737221c85efc79affc86fbaef9f1d2e8c8607070772ba92817bf36453f469'
    
      24            '839ec5b664010b53de065e9cadee4dc50a1519897b585016433973927ea0704f'
    
      25            '209f2bba163b033a6911ed879497d720a64095962f5b38dac2c476674d328269')
    
      26
    
      27case ${CARCH} in
    
      28        ${arch[0]})
    
      29                _CARCH="${_barch[0]}"
    
      30                ;;
    
      31        ${arch[1]})
    
      32                _CARCH="${_barch[1]}"
    
      33                ;;
    
      34        ${arch[2]})
    
      35                _CARCH="${_barch[2]}"
    
      36                ;;
    
      37esac
    
      38
    
      39BIN_FOLDER="${_pkgname}-${pkgver}/linux/${_CARCH}"
    
      40
    
      41package() {
    
      42	cd "${srcdir}/" || exit
    
      43
    
      44	for bin in ${_pkgexecs[@]}; do
    
      45        install -Dm755 "${BIN_FOLDER}/${bin}" "${pkgdir}/usr/bin/${bin}"
    
      46	done
    
      47
    
      48	install -Dm644 "README-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      49
    
      50	install -Dm644 "LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0