widemelon-bin

MEDIUM

maintainer pruefsumme 0 votes scanned 2026-09-11 17:22:59.755085

View on AUR

Why flagged

The package installs an AppImage from a GitHub release without verifying its internal integrity, posing a supply-chain risk if the source is compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs an AppImage from a GitHub release without verifying its internal integrity, posing a supply-chain risk if the source is compromised.

PKGBUILD

      1# Maintainer: pruefsumme <194605914+pruefsumme@users.noreply.github.com>
    
      2# Copyright (C) 2026 WideMelon contributors
    
      3# SPDX-License-Identifier: GPL-3.0-or-later
    
      4
    
      5pkgname=widemelon-bin
    
      6pkgver=1.0.2
    
      7pkgrel=1
    
      8pkgdesc='Widescreen Nintendo DS emulator based on melonDS (AppImage)'
    
      9arch=('x86_64')
    
      10url='https://github.com/pruefsumme/widemelon'
    
      11license=('GPL-3.0-or-later')
    
      12depends=('fuse2')
    
      13provides=('widemelon')
    
      14conflicts=('widemelon' 'widemelon-git')
    
      15options=('!strip' '!debug')
    
      16_appimage="WideMelon-${pkgver}-${CARCH}.AppImage"
    
      17source=("${_appimage}::https://github.com/pruefsumme/widemelon/releases/download/v${pkgver}/${_appimage}")
    
      18sha256sums=('b371af8ba5bba146194b4e51a6ceb152a0d62471e29ffc0df73b3bdbf7b90b71')
    
      19
    
      20prepare() {
    
      21  chmod +x "$_appimage"
    
      22  ./"$_appimage" --appimage-extract >/dev/null
    
      23}
    
      24
    
      25package() {
    
      26  install -Dm755 "$_appimage" \
    
      27    "$pkgdir/opt/widemelon/WideMelon.AppImage"
    
      28  install -d "$pkgdir/usr/bin"
    
      29  ln -s /opt/widemelon/WideMelon.AppImage "$pkgdir/usr/bin/widemelon"
    
      30
    
      31  install -Dm644 squashfs-root/usr/share/applications/io.github.pruefsumme.WideMelon.desktop \
    
      32    "$pkgdir/usr/share/applications/io.github.pruefsumme.WideMelon.desktop"
    
      33  install -Dm644 squashfs-root/usr/share/metainfo/io.github.pruefsumme.WideMelon.metainfo.xml \
    
      34    "$pkgdir/usr/share/metainfo/io.github.pruefsumme.WideMelon.metainfo.xml"
    
      35  local size
    
      36  for size in 16 32 48 64 128 256; do
    
      37    install -Dm644 "squashfs-root/usr/share/icons/hicolor/${size}x${size}/apps/io.github.pruefsumme.WideMelon.png" \
    
      38      "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/io.github.pruefsumme.WideMelon.png"
    
      39  done
    
      40  install -Dm644 squashfs-root/usr/share/doc/widemelon/LICENSE \
    
      41    "$pkgdir/usr/share/licenses/widemelon/LICENSE"
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-11 17:22:59	Medium	2