tempest-cli-bin

LOW

maintainer Ganyu_Genshin 0 votes scanned 2026-10-18 11:24:11.986802

View on AUR

Why flagged

Prebuilt binary downloaded from the project's own official domain (download.gotempest.app), with SHA-256 checksums provided; the host is plausibly the vendor's own release infrastructure, making this a normal binary packaging rather than a swappable third-party source.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Prebuilt binary downloaded from the project's own official domain (download.gotempest.app), with SHA-256 checksums provided; the host is plausibly the vendor's own release infrastructure, making this a normal binary packaging rather than a swappable third-party source.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source_x86_64=("tempest-cli_${pkgver}-1_amd64.deb::https://download.gotempest.app/cli/tempest-cli_${pkgver}-1_amd64.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ganyu_Genshin XianYuPigeon@outlook.com
    
      2pkgname=tempest-cli-bin
    
      3pkgver=3.17.2
    
      4pkgrel=1
    
      5pkgdesc="The all-platform terminal emulator CLI (official binary release)"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://gotempest.app"
    
      8license=('LicenseRef-proprietary')
    
      9depends=('systemd-libs' 'zlib')
    
      10provides=('tempest-cli')
    
      11conflicts=('tempest-cli')
    
      12options=('!strip' '!debug')
    
      13source_x86_64=("tempest-cli_${pkgver}-1_amd64.deb::https://download.gotempest.app/cli/tempest-cli_${pkgver}-1_amd64.deb")
    
      14# 上游公布值（SHA-256, hex）:
    
      15sha256sums_x86_64=('f4c81834c44acd9d8802283ec8f183ba37a71e0baa05df3ab3f537cd275cad93')
    
      16
    
      17source_aarch64=("tempest-cli_${pkgver}-1_arm64.deb::https://download.gotempest.app/cli/tempest-cli_${pkgver}-1_arm64.deb")
    
      18# 上游公布值（SHA-256, hex）:
    
      19sha256sums_aarch64=('1f04387d8d8f6f9317824ff980d1fd1095c3ae16fe2aba796c0fb12369ce3483')
    
      20
    
      21package() {
    
      22    # .deb 已在解包阶段由 makepkg 用 bsdtar 展开, 这里只取 data.tar.* 装入 pkgdir
    
      23    bsdtar -xf "$srcdir"/data.tar.* -C "$pkgdir"
    
      24    # SPDX LicenseRef-* 标识要求随包附许可证文件（上游 deb 自带的 copyright 声明）
    
      25    install -Dm644 "$pkgdir/usr/share/doc/tempest-cli/copyright" \
    
      26        "$pkgdir/usr/share/licenses/$pkgname/copyright"
    
      27}
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-18 11:24:11	Low	3
2026-10-18 11:22:05	Medium	2