stools-bin

MEDIUM

maintainer cap153 0 votes scanned 2026-09-04 07:57:01.997051

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release without verifiable checksums (SKIP), posing a supply-chain risk if the source is tampered with.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt binary from a GitHub release without verifiable checksums (SKIP), posing a supply-chain risk if the source is tampered with.

PKGBUILD

      1# Maintainer: cap153 <1536989047@qq.com>
    
      2
    
      3pkgname=stools-bin
    
      4pkgver=0.1.0
    
      5pkgrel=1
    
      6pkgdesc="A minimal, fast, Fuzzel-style application launcher with pinyin support"
    
      7arch=('x86_64')
    
      8url="https://github.com/cap153/stools"
    
      9license=('MIT')
    
      10provides=('stools')
    
      11conflicts=('stools')
    
      12options=('!strip')
    
      13
    
      14# 运行时依赖。libx11/libxcb/libxcursor/libxi/wayland/libglvnd 是 winit 与 femtovg
    
      15# 在运行时 dlopen 的：ldd 里看不到，但缺失会直接启动失败，请勿当作多余项删除。
    
      16# freetype2 会带入 zlib/bzip2/brotli/libpng，fontconfig 带入 expat，无需单列。
    
      17depends=(
    
      18    'glibc'
    
      19    'gcc-libs'
    
      20    'fontconfig'
    
      21    'freetype2'
    
      22    'libxkbcommon'
    
      23    'libx11'
    
      24    'libxcb'
    
      25    'libxcursor'
    
      26    'libxi'
    
      27    'wayland'
    
      28    'libglvnd'
    
      29)
    
      30optdepends=('mesa: OpenGL 驱动（使用 NVIDIA 专有驱动则不需要）')
    
      31
    
      32# 网络只下载二进制；desktop 与图标是本目录自带的本地文件。
    
      33source=(
    
      34    "stools-${pkgver}::https://github.com/cap153/stools/releases/download/v${pkgver}/stools"
    
      35    "stools.desktop"
    
      36    "stools.png"
    
      37)
    
      38# 第一项为 GitHub Release 二进制，上传前跑一次 `updpkgsums` 即可自动填入；
    
      39# 后两项是本地文件，哈希已固定（若改动过它们，重新跑一次 updpkgsums 即可）。
    
      40sha256sums=(
    
      41    'SKIP'
    
      42    'SKIP'
    
      43    'SKIP'
    
      44)
    
      45
    
      46package() {
    
      47    install -Dm755 "${srcdir}/stools-${pkgver}" "${pkgdir}/usr/bin/stools"
    
      48    install -Dm644 "${srcdir}/stools.desktop" "${pkgdir}/usr/share/applications/stools.desktop"
    
      49    install -Dm644 "${srcdir}/stools.png" "${pkgdir}/usr/share/icons/hicolor/64x64/apps/stools.png"
    
      50}
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-04 07:57:01	Medium	2