vkd3d-proton-clang-v4-bin
MEDIUM
maintainer guglovich
0 votes
scanned 2026-10-17 00:21:55.226236
Why flagged
The package installs a prebuilt binary from a GitHub release with an unverified checksum (SKIP), creating a supply-chain risk if the source were compromised.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Medium
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a GitHub release with an unverified checksum (SKIP), creating a supply-chain risk if the source were compromised.
PKGBUILD
1
# Maintainer: guglovich <guglovich164@gmail.com>
2
# Created with assistance from GLM 5.3 Flash.
3
pkgname=vkd3d-proton-clang-v4-bin
4
pkgver=3.0.1
5
pkgrel=1
6
pkgdesc="Argonforge Clang-built vkd3d-proton for x86-64-v4 (prebuilt)"
7
arch=('x86_64')
8
url="https://github.com/argonforge/vkd3d-proton-builds"
9
license=('MIT')
10
depends=('vulkan-icd-loader')
11
options=('!strip')
12
source=("vkd3d-proton-3.0.1-x86-64-v4.tar.zst::https://github.com/argonforge/vkd3d-proton-builds/releases/download/v3.0.1/vkd3d-proton-3.0.1-x86-64-v4.tar.zst")
13
sha256sums=('SKIP')
14
package() {
15
cd "${srcdir}"
16
bsdtar xf vkd3d-proton-3.0.1-x86-64-v4.tar.zst -C "${pkgdir}"
17
install -Dm644 /dev/stdin "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
18
}
19
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 00:28:05 | Medium | 2 |
| 2026-10-14 00:06:47 | Medium | 2 |
| 2026-10-13 00:23:45 | Medium | 2 |
| 2026-10-12 00:18:51 | Medium | 2 |
| 2026-10-11 00:26:05 | Medium | 2 |
| 2026-10-10 18:15:18 | Medium | 2 |