uniterm-fork-bin

MEDIUM

maintainer teejer 0 votes scanned 2026-10-06 00:13:36.889724

View on AUR

Why flagged

The package installs a prebuilt binary from a non-upstream, forked GitHub release (not the official project) without source compilation, creating a supply-chain risk if the release asset is swapped; however, it is checksummed and from a plausible project fork.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a non-upstream, forked GitHub release (not the official project) without source compilation, creating a supply-chain risk if the release asset is swapped; however, it is checksummed and from a plausible project fork.

PKGBUILD

      1# Maintainer: teejer <teejer@users.noreply.github.com>
    
      2# Fork build based on upstream v1.10.0 carrying one not-yet-upstream patch:
    
      3#   - Per-tab AI panel: the uniTerm AI conversation is tied to the active
    
      4#     terminal tab instead of being global (upstream PR #1091).
    
      5# The previous fork patches (AI thinking stream #1084, Wayland desktop-file
    
      6# app_id #1085) shipped in upstream v1.10.0 and are no longer carried here.
    
      7# Built by GitHub Actions from https://github.com/Teejer/uniterm (tag
    
      8# v1.10.0.pertab.1). Once PR #1091 ships in an official upstream release,
    
      9# retire this package and use uniterm-bin instead.
    
      10
    
      11pkgname=uniterm-fork-bin
    
      12pkgver=1.10.0.pertab.1
    
      13pkgrel=1
    
      14pkgdesc="Lightweight all-in-one terminal with 30+ protocols and a built-in autonomous AI agent (fork build: per-tab AI panel)"
    
      15arch=('x86_64' 'aarch64')
    
      16url="https://uniterm.net"
    
      17license=('Apache-2.0')
    
      18depends=('gtk3' 'webkit2gtk-4.1')
    
      19provides=('uniterm')
    
      20conflicts=('uniterm' 'uniterm-bin' 'uniterm-git')
    
      21options=('!strip' '!debug')
    
      22
    
      23_gh="https://github.com/Teejer/uniterm/releases/download/v${pkgver}"
    
      24
    
      25source_x86_64=(
    
      26  "${_gh}/uniterm-linux-amd64-v${pkgver}.deb"
    
      27  "LICENSE::https://raw.githubusercontent.com/Teejer/uniterm/v${pkgver}/LICENSE"
    
      28)
    
      29sha256sums_x86_64=(
    
      30  '1ee3c4dcd79d8685d7f71ef95a5407bdf41f3bec2b52c2d711a78e6c9afc073e'
    
      31  '80b7ddff03e2b4535e40a063a1079d4e02f57826720d6c9b2eb8d635bbec0715'
    
      32)
    
      33
    
      34source_aarch64=(
    
      35  "${_gh}/uniterm-linux-arm64-v${pkgver}.deb"
    
      36  "LICENSE::https://raw.githubusercontent.com/Teejer/uniterm/v${pkgver}/LICENSE"
    
      37)
    
      38sha256sums_aarch64=(
    
      39  '7c70defc7a94c70c25eb440b121c4ed45ddcd83487416a1fdd2280b7ced16bea'
    
      40  '80b7ddff03e2b4535e40a063a1079d4e02f57826720d6c9b2eb8d635bbec0715'
    
      41)
    
      42
    
      43package() {
    
      44  # makepkg already unpacked the .deb (an ar archive) into $srcdir,
    
      45  # leaving its payload in data.tar.*. Install that verbatim: /usr/bin/uniterm,
    
      46  # /usr/share/applications/org.wails.uniterm.desktop (matches the Wayland
    
      47  # app_id; see upstream PR #1085) and the hicolor icons.
    
      48  bsdtar -xf "${srcdir}"/data.tar.* -C "${pkgdir}"
    
      49
    
      50  install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 00:13:36	Medium	2
2026-10-05 23:40:58	Medium	2