vinci-client-bin

MEDIUM

maintainer Alp 0 votes scanned 2026-09-16 00:03:17.191873

View on AUR

Why flagged

The package downloads a prebuilt .deb from a private GitHub repository using a custom download script, which is unverifiable and could be silently swapped; this constitutes a supply-chain risk despite plausible project association.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a private GitHub repository using a custom download script, which is unverifiable and could be silently swapped; this constitutes a supply-chain risk despite plausible project association.

PKGBUILD

      1# Maintainer: Alper Ortac <alportac@gmail.com>
    
      2pkgname=vinci-client-bin
    
      3pkgver=0.1.1
    
      4pkgrel=1
    
      5pkgdesc='Vinci, your second brain (prebuilt; requires private repository access)'
    
      6arch=('x86_64')
    
      7url='https://github.com/meetvinci/vinci'
    
      8license=('LicenseRef-proprietary')
    
      9depends=('glibc' 'libgcc' 'gtk3' 'webkit2gtk-4.1' 'libsoup3' 'glib2' 'cairo' 'gdk-pixbuf2' 'dbus' 'hicolor-icon-theme')
    
      10makedepends=('github-cli')
    
      11provides=("vinci=$pkgver")
    
      12conflicts=('vinci')
    
      13options=('!strip' '!debug')
    
      14# gh uses the caller's login or GH_TOKEN. No credentials are stored here.
    
      15DLAGENTS+=("vinci::/usr/bin/bash ${startdir}/download.sh %u %o")
    
      16source=("vinci-${pkgver}-amd64.deb::vinci://565930918" 'download.sh')
    
      17sha256sums=('9ab22fe2b599bbb6f525980ccf62d9d1ebed9e3c3a5f2b4abf1c4dca73eb85e9'
    
      18            '690e066bdf9fddc809d5810903966c5109bc8aaf75a2cf55c837e9e1f3147c5a')
    
      19
    
      20package() {
    
      21  bsdtar -xf "$srcdir/data.tar.gz" -C "$pkgdir"
    
      22}
    
      23

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-16 00:03:17	Medium	2
2026-09-15 23:20:44	Medium	2