starling-office-bin

MEDIUM

maintainer tee 0 votes scanned 2026-10-18 13:22:09.532316

View on AUR

Why flagged

The package installs a prebuilt binary .deb from GitHub releases without source availability or reproducibility, creating a supply-chain risk despite the project being open source.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary .deb from GitHub releases without source availability or reproducibility, creating a supply-chain risk despite the project being open source.

PKGBUILD

      1# Maintainer: tee < teeaur at duck dot com >
    
      2pkgname=starling-office-bin
    
      3pkgver=0.1.0
    
      4pkgrel=1
    
      5pkgdesc='Documents, presentations, and spreadsheets in one free, open source suite'
    
      6arch=(x86_64)
    
      7url='https://starling.build'
    
      8license=(Apache-2.0)
    
      9depends=(bash glib2 glibc gtk3 hicolor-icon-theme libinput wayland zlib)
    
      10source=("https://github.com/starling-build/starling/releases/download/office-v$pkgver/starling-office_${pkgver}_amd64.deb")
    
      11b2sums=('cc276fa98cc94ed49a8826d69fc471478cdd9d8d0241640bcc67b04ae162c0e50856802429aa8ece1224f850ee67887fcb845bfbbbe5ee3e86d62f706d43613e')
    
      12
    
      13package() {
    
      14  tar -xf data.tar.zst -C "$pkgdir"
    
      15  cd "$pkgdir"
    
      16  chmod 755 usr usr/bin usr/lib
    
      17  chmod -R 755 usr/share
    
      18  chmod 775 usr/share/doc/starling-office
    
      19}
    
      20

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-18 13:22:09	Medium	2