trenchbroom-appimage-latest

maintainer S410 · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package downloads and repackages a legitimate AppImage from the project's official GitHub repository; the low severity is due to unverifiable origin of the binary and lack of source build, but no malicious behavior is present.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads and repackages a legitimate AppImage from the project's official GitHub repository; the low severity is due to unverifiable origin of the binary and lack of source build, but no malicious behavior is present.

PKGBUILD

      1# Maintainer: Sierra410 <(my nickname)@protonmail.com>
    
      2# Contributor: Steven Dwy <me@yoplitein.net>
    
      3# Based on trenchbroom-appimage
    
      4
    
      5pkgname=trenchbroom-appimage-latest
    
      6pkgver=2026.1
    
      7pkgrel=1
    
      8pkgdesc="Cross-platform level editor for Quake-engine based games. Latest AppImage from GitHub"
    
      9arch=("x86_64")
    
      10url="https://trenchbroom.github.io/"
    
      11_repo="TrenchBroom/TrenchBroom"
    
      12license=("GPL3")
    
      13provides=("trenchbroom")
    
      14conflicts=("trenchbroom-appimage")
    
      15makedepends=(
    
      16	"unzip"
    
      17	"jq"
    
      18)
    
      19source=("TrenchBroom-appimage.desktop")
    
      20sha256sums=("ffc16fddb9a288dbad411fff296cf630d70d97a2bc655b66dd731318d5dcfdc4")
    
      21options=(
    
      22	!debug
    
      23	!strip # stripping seems to nuke AppImage data
    
      24)
    
      25
    
      26pkgver() {
    
      27	if [ -z "$_pkgver" ]; then
    
      28		_pkgver="$(curl -s \
    
      29			-H 'Accept: application/vnd.github+json' \
    
      30			"https://api.github.com/repos/$_repo/releases/latest" \
    
      31				| jq -r '.tag_name | sub("^v"; "")'
    
      32		)"
    
      33	fi
    
      34
    
      35	echo "$_pkgver"
    
      36}
    
      37
    
      38prepare() {
    
      39	pkgver
    
      40
    
      41	local zip="./${pkgname}-${_pkgver}.zip"
    
      42	if [ ! -f "$zip" ]; then
    
      43		curl -L -o "$zip" \
    
      44			"https://github.com/$_repo/releases/download/v$_pkgver/TrenchBroom-Linux-$CARCH-v$_pkgver-Release.zip"
    
      45		unzip -o "$zip"
    
      46	fi
    
      47
    
      48	local iconPath="usr/share/icons/hicolor/256x256/apps/trenchbroom.png"
    
      49	./TrenchBroom.AppImage --appimage-extract "$iconPath"
    
      50	mv "squashfs-root/$iconPath" .
    
      51}
    
      52
    
      53package() {
    
      54	install -Dm755 TrenchBroom.AppImage "$pkgdir/usr/lib/TrenchBroom.AppImage"
    
      55	install -Dm644 TrenchBroom-appimage.desktop "$pkgdir/usr/share/applications/TrenchBroom-appimage.desktop"
    
      56	install -Dm644 trenchbroom.png "$pkgdir/usr/share/icons/hicolor/256x256/apps/trenchbroom-appimage.png"
    
      57}
    
      58

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 03:27:23	LOW	2