venera-prime-bin

MEDIUM

maintainer Lilinzta 0 votes scanned 2026-10-06 00:13:36.889724

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release (unofficial host for binaries), which is a supply-chain risk if the source is swapped, though it's checksum-verified and likely the project's own release.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a GitHub release (unofficial host for binaries), which is a supply-chain risk if the source is swapped, though it's checksum-verified and likely the project's own release.

PKGBUILD

      1# Maintainer: Haotian Li <lilinzta@gmail.com>
    
      2# Maintainer: taotieren <admin@taotieren.com>
    
      3
    
      4pkgname=venera-prime-bin
    
      5pkgdesc="A comic reader that support reading local and network comics. (Prime)"
    
      6pkgver=2.4.2
    
      7pkgrel=1
    
      8arch=('x86_64')
    
      9url="https://github.com/venera-app/venera-prime"
    
      10license=('GPL-3.0-only')
    
      11depends=('at-spi2-core' 'cairo' 'fontconfig' 'gcc-libs' 'glib2' 'glibc' 'gdk-pixbuf2' 'gtk3' 'harfbuzz' 'libepoxy' 'libsoup3' 'pango' 'webkit2gtk-4.1')
    
      12conflicts=('venera' 'venera-bin')
    
      13options=('!debug')
    
      14source=("${url}/releases/download/v${pkgver}/venera_${pkgver}_amd64.deb")
    
      15sha256sums=('ea9a86ce252611918732882b02959f556d184cb408adca6ce1280bd294cdb641')
    
      16
    
      17package() {
    
      18    tar -I zstd -xf data.tar.zst --numeric-owner -C "${pkgdir}/"
    
      19    install -dm755 "${pkgdir}/usr/bin"
    
      20    cp -R ${pkgdir}/usr/local/lib/venera ${pkgdir}/usr/share/
    
      21    rm -rf ${pkgdir}/usr/local/
    
      22    sed -i 's|/usr/local/lib/venera/||g' ${pkgdir}/usr/share/applications/venera.desktop
    
      23    ln -sf /usr/share/venera/venera "${pkgdir}/usr/bin/"
    
      24    chown -R root:root "${pkgdir}"
    
      25}
    
      26

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 00:13:36	Medium	2
2026-10-05 23:40:58	Low	1