viff-bin

MEDIUM

maintainer zxp19821005 0 votes scanned 2026-11-06 12:12:41.156139

View on AUR

Why flagged

The package downloads a prebuilt .deb from a GitHub release, which is an unverifiable binary executable from a potentially swappable host, posing a supply-chain risk if the source were compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The package downloads a prebuilt .deb from a GitHub release, which is an unverifiable binary executable from a potentially swappable host, posing a supply-chain risk if the source were compromised.

PKGBUILD

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=viff-bin
    
      3_pkgname=Viff
    
      4pkgver=0.3.0
    
      5pkgrel=1
    
      6pkgdesc="A lightweight, native Git client, with a read-only project browser, an English/Chinese interface, and optional AI-written commit messages."
    
      7arch=('x86_64')
    
      8url="https://github.com/1lck/viff"
    
      9license=('MIT')
    
      10provides=("${pkgname%-bin}=${pkgver}")
    
      11conflicts=("${pkgname%-bin}")
    
      12depends=(
    
      13    'glibc'
    
      14    'hicolor-icon-theme'
    
      15)
    
      16source=("${pkgname%-bin}-${pkgver}.deb::${url}/releases/download/v${pkgver}/${pkgname%-bin}-v${pkgver}-linux-amd64.deb")
    
      17sha256sums=('aeacda73a2e14ce7025cbf9ed22cb7fe3481400bd233786d7f46f96ab6e31c74')
    
      18_install_icons() {
    
      19	local _src="${1:-${srcdir}}" _name="${pkgname%-bin}" _icon _ext _size _dest
    
      20	while IFS= read -r -d '' _icon; do
    
      21		_ext="${_icon##*.}"
    
      22		_size=$(echo "${_icon%/*}" | grep -oE '[0-9]+x[0-9]+|scalable' | head -1)
    
      23		[[ -z "${_size}" ]] && _size=$([[ "${_ext}" == svg ]] && echo scalable || od -An -tu1 -j16 -N8 "${_icon}" 2>/dev/null | awk '{printf "%dx%d",$1*16777216+$2*65536+$3*256+$4,$5*16777216+$6*65536+$7*256+$8}')
    
      24		[[ "${_size}" =~ ^[0-9]+x[0-9]+$ ]] || _size=scalable
    
      25		_dest=$([[ "${_icon}" == */share/pixmaps/* ]] && echo pixmaps || echo "icons/hicolor/${_size}/apps")
    
      26		install -Dm644 "${_icon}" "${pkgdir}/usr/share/${_dest}/${_name}.${_ext}"
    
      27	done < <(find "${_src}" \( -path '*/share/icons/*' -o -path '*/share/pixmaps/*' -o -path '*entries/icons/*' \) -type f \( -name '*.png' -o -name '*.svg' \) -print0 2>/dev/null)
    
      28}
    
      29prepare() {
    
      30    bsdtar -xf "${srcdir}/data."*
    
      31    sed -i -e "
    
      32        s/Name=${pkgname%-bin}/Name=${_pkgname}/g
    
      33        s/Categories=Development/Categories=Utility/g
    
      34    " "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop"
    
      35}
    
      36package() {
    
      37    install -Dm755 "${srcdir}/usr/bin/${pkgname%-bin}" -t "${pkgdir}/usr/bin"
    
      38    _install_icons
    
      39    install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
    
      40    install -Dm644 "${srcdir}/usr/share/doc/${pkgname%-bin}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      41    install -Dm644 "${srcdir}/usr/share/doc/${pkgname%-bin}/README"* -t "${pkgdir}/usr/share/doc/${pkgname}"
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-06 12:12:41	Medium	2