vy-bin

LOW

maintainer Dominiquini 1 votes scanned 2026-09-16 05:21:26.620361

View on AUR

Why flagged

The package downloads prebuilt binaries from GitHub releases, which is a common but less trustworthy practice; however, the sources are verifiable via checksums and hosted on an official project infrastructure, limiting risk to typical supply-chain concerns for binary packages.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads prebuilt binaries from GitHub releases, which is a common but less trustworthy practice; however, the sources are verifiable via checksums and hosted on an official project infrastructure, limiting risk to typical supply-chain concerns for binary packages.

PKGBUILD

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      2
    
      3_pkgauthor=ynqa
    
      4_pkgname=vy
    
      5_appname=${_pkgname}-cli
    
      6pkgname=${_pkgname}-bin
    
      7pkgdesc="Explore and query JSON and YAML, right in your terminal"
    
      8
    
      9pkgver=0.1.0
    
      10pkgrel=1
    
      11_pkgvername=v${pkgver}
    
      12
    
      13arch=('x86_64' 'aarch64')
    
      14_barch=('x86_64-unknown-linux-gnu' 'aarch64-unknown-linux-gnu')
    
      15
    
      16url="https://github.com/${_pkgauthor}/${_pkgname}"
    
      17_urlraw="https://raw.githubusercontent.com/${_pkgauthor}/${_pkgname}/${_pkgvername}"
    
      18
    
      19license=('MIT')
    
      20
    
      21provides=("${_pkgname}")
    
      22conflicts=("${_pkgname}")
    
      23depends=('glibc' 'libgcc')
    
      24
    
      25source_x86_64=("${_pkgname}-${arch[0]}-${pkgver}.txz::${url}/releases/download/${_pkgvername}/${_appname}-${_barch[0]}.tar.xz")
    
      26source_aarch64=("${_pkgname}-${arch[1]}-${pkgver}.txz::${url}/releases/download/${_pkgvername}/${_appname}-${_barch[1]}.tar.xz")
    
      27sha256sums_x86_64=('248194408c38d7204458e56149b8ae5ebcc3b9202910aa48a79e4359d3a62bee')
    
      28sha256sums_aarch64=('acf05c738f90863d441d3dba0a1df0c391133c3520ed31edf8f19a836ec01dbb')
    
      29
    
      30
    
      31case ${CARCH} in
    
      32	${arch[0]})
    
      33		_CARCH="${_barch[0]}"
    
      34		;;
    
      35	${arch[1]})
    
      36		_CARCH="${_barch[1]}"
    
      37		;;
    
      38esac
    
      39
    
      40package() {
    
      41	cd "${srcdir}/${_appname}-${_CARCH}" || exit
    
      42
    
      43	install -Dm755 "${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      44
    
      45	install -Dm644 "default.toml" "${pkgdir}/usr/share/doc/${pkgname}/config/config.example.toml"
    
      46
    
      47	install -Dm644 "README.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      48
    
      49	install -Dm644 "LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      50}
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-16 05:21:26	Low	2