tauri-motrix-bin

MEDIUM

maintainer zxp19821005 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package installs a prebuilt .deb binary from a GitHub release not on a trust whitelist, which is unverifiable and could be swapped by an unrelated party, constituting a supply-chain risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt .deb binary from a GitHub release not on a trust whitelist, which is unverifiable and could be swapped by an unrelated party, constituting a supply-chain risk.

PKGBUILD

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=tauri-motrix-bin
    
      3_pkgname=Tauri.Motrix
    
      4pkgver=0.2.5
    
      5pkgrel=1
    
      6pkgdesc="A full-featured download manager written in Tauri.The purpose is to restructure Motrix open source project."
    
      7arch=(
    
      8	'aarch64'
    
      9	'x86_64'
    
      10)
    
      11url="https://tauri-motrix-website.vercel.app/"
    
      12_ghurl="https://github.com/Taoister39/tauri-motrix"
    
      13license=('GPL-3.0-only')
    
      14conflicts=("${pkgname%-bin}")
    
      15provides=("${pkgname%-bin}=${pkgver}")
    
      16depends=(
    
      17	'gtk3'
    
      18	'gdk-pixbuf2'
    
      19	'webkit2gtk-4.1'
    
      20	'libayatana-indicator'
    
      21	'libappindicator'
    
      22    'aria2'
    
      23)
    
      24source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.deb::${_ghurl}/releases/download/v${pkgver}/${_pkgname}_${pkgver}_arm64.deb")
    
      25source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.deb::${_ghurl}/releases/download/v${pkgver}/${_pkgname}_${pkgver}_amd64.deb")
    
      26sha256sums_aarch64=('72a5b85df06ef64d5fe5f3641cf06d91bfb2b091a6e5f41b2e90e3bcb494342c')
    
      27sha256sums_x86_64=('224679600aa038bd45dae6a87c9431702dacfdf818564da9e3001c6762c94365')
    
      28prepare() {
    
      29    bsdtar -xf "${srcdir}/data."*
    
      30	sed -i -e "
    
      31		s/Categories=Utility;/Categories=Network;/g
    
      32		/Comment/d
    
      33        4i\Comment=${pkgdesc}
    
      34	" "${srcdir}/usr/share/applications/${_pkgname//./ }.desktop"
    
      35	[[ -d "${srcdir}/usr/share/icons/hicolor/256x256@2" ]] && mv "${srcdir}/usr/share/icons/hicolor/256x256@2" "${srcdir}/usr/share/icons/hicolor/512x512"
    
      36}
    
      37package() {
    
      38	install -Dm755 "${srcdir}/usr/bin/${pkgname%-bin}" -t "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      39	[ -d "${srcdir}/usr/lib" ] && cp -a "${srcdir}/usr/lib" "${pkgdir}/usr/"
    
      40	find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
    
      41		_extension="${_i##*.}"
    
      42		_icon_path="${_i#*share/icons/}"
    
      43		_target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
    
      44		install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
    
      45	done
    
      46	install -Dm644 "${srcdir}/usr/share/applications/${_pkgname//./ }.desktop" "${pkgdir}/usr/share/applications/${pkgname%-bin}.desktop"
    
      47}

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 03:10:23	Medium	2