tuxmix-bin

MEDIUM

maintainer ismail-bahloul 0 votes scanned 2026-10-30 00:29:30.650963

View on AUR

Why flagged

The package installs prebuilt binaries from a GitHub release, which are not built from source, creating an unverifiable supply-chain risk despite the project being open-source.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs prebuilt binaries from a GitHub release, which are not built from source, creating an unverifiable supply-chain risk despite the project being open-source.

PKGBUILD

      1# Maintainer: Ismaïl Bahloul <i.bahloul01@gmail.com>
    
      2
    
      3# TuxMix — Open-source TotalMix replacement for RME audio interfaces on Linux
    
      4#
    
      5# The prebuilt binaries the release workflow (.github/workflows/release.yml)
    
      6# attaches to each GitHub release: no Rust toolchain, no build. The `tuxmix`
    
      7# package builds the same thing from source.
    
      8#
    
      9# When a new version is released, update pkgver and run updpkgsums.
    
      10
    
      11pkgname=tuxmix-bin
    
      12pkgver=0.3.5
    
      13pkgrel=1
    
      14pkgdesc="Open-source TotalMix replacement for RME audio interfaces on Linux (prebuilt)"
    
      15arch=('x86_64')
    
      16url="https://github.com/ismail-bahloul/TuxMix"
    
      17license=('GPL-3.0-only')
    
      18depends=(
    
      19    'alsa-lib'
    
      20    'gcc-libs'
    
      21    'glibc'
    
      22    'libgl'
    
      23    'systemd-libs'
    
      24)
    
      25provides=("tuxmix=${pkgver}")
    
      26conflicts=('tuxmix')
    
      27options=('!strip' '!debug')
    
      28source=("${url}/releases/download/v${pkgver}/tuxmix-${pkgver}-x86_64.tar.gz")
    
      29sha256sums=('6c95c6aed78ff7f19d57cba485a1412defdf4ac4df63088d4c8bd31958e6d411')
    
      30
    
      31package() {
    
      32    # The tarball is the installed tree (tools/release/package.sh).
    
      33    cp -a "${srcdir}/tuxmix-${pkgver}-x86_64/usr" "${pkgdir}/"
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-30 00:29:30	Medium	2
2026-10-29 23:54:04	Medium	2