t3-code-bin

LOW

maintainer czyt 0 votes scanned 2026-11-05 04:08:19.306895

View on AUR

Why flagged

The package installs a prebuilt Electron binary from GitHub Releases, which is a common and generally acceptable practice for AUR packages; while the binary is not built from source, it comes from the project's official repository with verifiable checksums, and no malicious behavior or code execution from untrusted sources is present.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt Electron binary from GitHub Releases, which is a common and generally acceptable practice for AUR packages; while the binary is not built from source, it comes from the project's official repository with verifiable checksums, and no malicious behavior or code execution from untrusted sources is present.

PKGBUILD

      1# Maintainer: czyt <czytcn@gmail.com>
    
      2
    
      3pkgname=t3-code-bin
    
      4pkgver=0.1.7
    
      5pkgrel=1
    
      6pkgdesc="Desktop GUI for coding agents"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://t3.codes"
    
      9license=('MIT')
    
      10depends=(
    
      11  'alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'gdk-pixbuf2' 'glib2'
    
      12  'glibc' 'gtk3' 'hicolor-icon-theme' 'libcups' 'libgcc' 'libnotify'
    
      13  'libsecret' 'libstdc++' 'libx11' 'libxcb' 'libxcomposite' 'libxdamage'
    
      14  'libxext' 'libxfixes' 'libxkbcommon' 'libxrandr' 'libxss' 'libxtst'
    
      15  'mesa' 'nspr' 'nss' 'pango' 'systemd-libs' 'util-linux-libs' 'xdg-utils'
    
      16)
    
      17optdepends=('libappindicator-gtk3: system tray indicator support')
    
      18provides=('t3code')
    
      19conflicts=('t3code' 't3code-bin')
    
      20options=('!strip' '!debug')
    
      21
    
      22_deb_x86_64="T3-Code-${pkgver}-amd64.deb"
    
      23_deb_aarch64="T3-Code-${pkgver}-arm64.deb"
    
      24source_x86_64=("${_deb_x86_64}::https://github.com/pingdotgg/t3code/releases/download/v${pkgver}/${_deb_x86_64}")
    
      25source_aarch64=("${_deb_aarch64}::https://github.com/pingdotgg/t3code/releases/download/v${pkgver}/${_deb_aarch64}")
    
      26noextract=("${_deb_x86_64}" "${_deb_aarch64}")
    
      27sha256sums_x86_64=('e1373f8047ba582f2e40aff4b34b57d9a355513d4fb47c34d49d11b5c870f9fe')
    
      28sha256sums_aarch64=('94e0c9b3b5e9735f8570df6da1feb6f89dc9c0e1c842e8dfbd020e957345e0ca')
    
      29
    
      30package() {
    
      31  local _deb_var="_deb_${CARCH}"
    
      32  local _deb="${!_deb_var}"
    
      33  [[ -n "${_deb}" ]] || { echo "unsupported architecture: ${CARCH}" >&2; return 1; }
    
      34
    
      35  local _data_member
    
      36  _data_member=$(ar t "${srcdir}/${_deb}" |
    
      37    awk '/^data\.tar\.(gz|xz|zst|bz2|lzma)$/ { print; exit }')
    
      38  [[ -n "${_data_member}" ]] || { echo "deb has no supported data archive" >&2; return 1; }
    
      39
    
      40  ar p "${srcdir}/${_deb}" "${_data_member}" |
    
      41    bsdtar --no-same-owner -xf - -C "${pkgdir}"
    
      42
    
      43  # Upstream installs into "/opt/T3 Code (Beta)": a path with spaces and a
    
      44  # release-channel suffix breaks shell tooling and moves with the channel.
    
      45  install -dm755 "${pkgdir}/usr/lib"
    
      46  mv "${pkgdir}/opt/T3 Code (Beta)" "${pkgdir}/usr/lib/${pkgname}"
    
      47  rmdir "${pkgdir}/opt"
    
      48
    
      49  install -Dm644 "${pkgdir}/usr/share/doc/t3code/copyright" \
    
      50    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      51  rm -r "${pkgdir}/usr/share/doc"
    
      52
    
      53  # The Debian postinst creates this link; pacman does not run maintainer scripts.
    
      54  install -dm755 "${pkgdir}/usr/bin"
    
      55  ln -s "/usr/lib/${pkgname}/t3code" "${pkgdir}/usr/bin/t3code"
    
      56
    
      57  # Point the desktop entry at the wrapper on PATH instead of the deb's path.
    
      58  sed -i 's|^Exec=.*|Exec=/usr/bin/t3code %U|' \
    
      59    "${pkgdir}/usr/share/applications/t3code.desktop"
    
      60
    
      61  # Keep the shipped AppArmor profile aligned with the relocated payload.
    
      62  local _profile="${pkgdir}/usr/lib/${pkgname}/resources/apparmor-profile"
    
      63  [[ -f "${_profile}" ]] &&
    
      64    sed -i "s|\"/opt/T3 Code (Beta)/t3code\"|\"/usr/lib/${pkgname}/t3code\"|" "${_profile}"
    
      65
    
      66  chmod -R u=rwX,go=rX "${pkgdir}"
    
      67  chown -R root:root "${pkgdir}"
    
      68
    
      69  # Electron's SUID sandbox helper for kernels without unprivileged user
    
      70  # namespaces; the Debian postinst would set this after checking the kernel.
    
      71  chmod 4755 "${pkgdir}/usr/lib/${pkgname}/chrome-sandbox"
    
      72}
    
      73

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-05 04:08:19	Low	2