vellum-bin

LOW

maintainer CPT_Dawn 0 votes scanned 2026-11-01 18:01:05.785766

View on AUR

Why flagged

The package installs prebuilt binaries from the project's official GitHub releases, which is a normal AUR practice; the low severity is due to the unverified origin of the binaries despite matching checksums, but no malicious behavior is evident.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs prebuilt binaries from the project's official GitHub releases, which is a normal AUR practice; the low severity is due to the unverified origin of the binaries despite matching checksums, but no malicious behavior is evident.

PKGBUILD

      1# Maintainer: CPT-Dawn <ping@cptdawn.dev>
    
      2pkgname=vellum-bin
    
      3pkgver=2.0.1
    
      4pkgrel=1
    
      5pkgdesc="Featherweight wallpaper manager for Wayland: a tiny daemon, CLI and TUI (prebuilt)"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/CPT-Dawn/Vellum"
    
      8license=('MIT OR Apache-2.0')
    
      9depends=('glibc' 'libgcc')
    
      10provides=('vellum')
    
      11conflicts=('vellum' 'vellum-git')
    
      12options=('!debug' '!strip')
    
      13_version=2.0.1
    
      14_tag=v2.0.1
    
      15source_x86_64=("$pkgname-$pkgver-x86_64.tar.gz::$url/releases/download/$_tag/vellum-$_version-x86_64-unknown-linux-gnu.tar.gz")
    
      16source_aarch64=("$pkgname-$pkgver-aarch64.tar.gz::$url/releases/download/$_tag/vellum-$_version-aarch64-unknown-linux-gnu.tar.gz")
    
      17sha256sums_x86_64=('672989dd5a51617b95281d25d266ba88852672ceeb8d22d27876caa3c294010e')
    
      18sha256sums_aarch64=('9d8c6af3ea772bde9664716d514c73431a7ec930d23ec27b46bfaa73f9045e4c')
    
      19
    
      20package() {
    
      21  cd "vellum-$_version-$CARCH-unknown-linux-gnu"
    
      22  install -Dm755 vellum vellumd -t "$pkgdir/usr/bin"
    
      23  install -Dm644 vellumd.service -t "$pkgdir/usr/lib/systemd/user"
    
      24
    
      25  install -Dm644 completions/vellum.bash \
    
      26    "$pkgdir/usr/share/bash-completion/completions/vellum"
    
      27  install -Dm644 completions/_vellum -t "$pkgdir/usr/share/zsh/site-functions"
    
      28  install -Dm644 completions/vellum.fish -t "$pkgdir/usr/share/fish/vendor_completions.d"
    
      29  install -Dm644 man/*.1 -t "$pkgdir/usr/share/man/man1"
    
      30
    
      31  install -Dm644 README.md -t "$pkgdir/usr/share/doc/$pkgname"
    
      32  install -Dm644 LICENSE-MIT LICENSE-APACHE -t "$pkgdir/usr/share/licenses/$pkgname"
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 18:01:05	Low	2