tidra-bin

MEDIUM

maintainer stiermid 0 votes scanned 2026-11-06 12:12:41.156139

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release, which is unverifiable and could be silently swapped, posing a supply-chain risk despite the project being legitimate.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a GitHub release, which is unverifiable and could be silently swapped, posing a supply-chain risk despite the project being legitimate.

PKGBUILD

      1# Maintainer: Agil Mammadov <mammadovagil@proton.me>
    
      2
    
      3pkgname=tidra-bin
    
      4pkgver=0.1.6
    
      5pkgrel=1
    
      6pkgdesc="Keep every project you maintain up to date from one desktop app (prebuilt)"
    
      7arch=('x86_64')
    
      8url="https://github.com/yusifaliyevpro/tidra-app"
    
      9license=('AGPL-3.0-or-later')
    
      10depends=(
    
      11    cairo
    
      12    dbus
    
      13    gdk-pixbuf2
    
      14    git
    
      15    glib2
    
      16    glibc
    
      17    gtk3
    
      18    hicolor-icon-theme
    
      19    libappindicator
    
      20    libgcc
    
      21    libsoup3
    
      22    libx11
    
      23    libxi
    
      24    sh
    
      25    util-linux
    
      26    'webkit2gtk-4.1'
    
      27)
    
      28optdepends=(
    
      29    'org.freedesktop.secrets: store tokens in the desktop keyring'
    
      30    'nodejs: manage Node.js projects'
    
      31    'npm: manage npm projects'
    
      32    'pnpm: manage pnpm projects'
    
      33    'yarn: manage Yarn projects'
    
      34    'bun: manage Bun projects'
    
      35    'github-cli: import an existing GitHub CLI authentication token'
    
      36)
    
      37provides=("tidra=$pkgver")
    
      38conflicts=('tidra')
    
      39options=('!strip' '!debug')
    
      40source=("$pkgname-$pkgver-amd64.deb::$url/releases/download/v$pkgver/Tidra_${pkgver}_amd64.deb")
    
      41sha256sums=('ffe509fb5d82fcc11ef0283267ccfc09d2d5a19f8d285fdd254726db9c0029f8')
    
      42
    
      43prepare() {
    
      44    bsdtar -xf data.tar.gz
    
      45}
    
      46
    
      47package() {
    
      48    install -Dm755 usr/bin/tidra "$pkgdir/usr/bin/tidra"
    
      49    install -Dm644 usr/share/applications/Tidra.desktop \
    
      50        "$pkgdir/usr/share/applications/tidra.desktop"
    
      51
    
      52    local size
    
      53    for size in 32 128; do
    
      54        install -Dm644 "usr/share/icons/hicolor/${size}x${size}/apps/tidra.png" \
    
      55            "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/tidra.png"
    
      56    done
    
      57    install -Dm644 usr/share/icons/hicolor/256x256@2/apps/tidra.png \
    
      58        "$pkgdir/usr/share/icons/hicolor/256x256/apps/tidra.png"
    
      59}
    
      60

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-06 12:12:41	Medium	2