vacuumtube-bin

maintainer Felitendo · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs a prebuilt binary from the project's official GitHub release page, which is a common and reasonable practice for Electron apps; the binary is not obfuscated or executed remotely, and the source is verifiable via checksum, making the risk low despite the binary origin.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from the project's official GitHub release page, which is a common and reasonable practice for Electron apps; the binary is not obfuscated or executed remotely, and the source is verifiable via checksum, making the risk low despite the binary origin.

PKGBUILD

      1# Maintainer: Felitendo
    
      2# This PKGBUILD is updated automatically:
    
      3# https://github.com/Felitendo/PKGBUILDS
    
      4
    
      5pkgname=vacuumtube-bin
    
      6pkgver=1.8.2
    
      7pkgrel=1
    
      8pkgdesc="YouTube Leanback (TV UI) in Electron, with a built-in adblocker (upstream binary)"
    
      9arch=('x86_64')
    
      10url="https://github.com/shy1132/VacuumTube"
    
      11license=('MIT')
    
      12depends=('gtk3' 'nss' 'alsa-lib' 'libnotify' 'libxss' 'libxtst' 'xdg-utils'
    
      13         'at-spi2-core' 'util-linux-libs' 'libsecret')
    
      14optdepends=('libappindicator-gtk3: tray icon support')
    
      15provides=('vacuumtube')
    
      16conflicts=('vacuumtube')
    
      17options=('!strip' '!debug')
    
      18source=("${pkgname}-${pkgver}.deb::https://github.com/shy1132/VacuumTube/releases/download/v${pkgver}/VacuumTube-amd64.deb")
    
      19noextract=("${pkgname}-${pkgver}.deb")
    
      20sha256sums=('9da27e553b982985a3c2112eed3a0e819dd0c5492b72c8038d2fffcd58399fd5')
    
      21
    
      22package() {
    
      23  bsdtar -xOf "$srcdir/${pkgname}-${pkgver}.deb" 'data.tar.*' \
    
      24    | bsdtar -xpf - -C "$pkgdir" --exclude './usr/share/doc' ./opt ./usr
    
      25  install -d "$pkgdir/usr/bin"
    
      26  ln -s /opt/VacuumTube/vacuumtube "$pkgdir/usr/bin/vacuumtube"
    
      27}
    
      28

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -3,7 +3,7 @@
 # https://github.com/Felitendo/PKGBUILDS
 
 pkgname=vacuumtube-bin
-pkgver=1.8.1
+pkgver=1.8.2
 pkgrel=1
 pkgdesc="YouTube Leanback (TV UI) in Electron, with a built-in adblocker (upstream binary)"
 arch=('x86_64')
@@ -17,7 +17,7 @@
 options=('!strip' '!debug')
 source=("${pkgname}-${pkgver}.deb::https://github.com/shy1132/VacuumTube/releases/download/v${pkgver}/VacuumTube-amd64.deb")
 noextract=("${pkgname}-${pkgver}.deb")
-sha256sums=('652be4e29e85ed31d3a1bae4dad00e6d39967ad0cf7cc47547b0ec94bacd0d51')
+sha256sums=('9da27e553b982985a3c2112eed3a0e819dd0c5492b72c8038d2fffcd58399fd5')
 
 package() {
   bsdtar -xOf "$srcdir/${pkgname}-${pkgver}.deb" 'data.tar.*' \

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 03:17:12	LOW	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 09:27:42	MEDIUM	2