wuyou-toolkit

MEDIUM

maintainer duanluan 0 votes scanned 2026-08-21 21:15:20.444724

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release without source code availability, creating a supply-chain risk due to lack of verifiability.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt binary from a GitHub release without source code availability, creating a supply-chain risk due to lack of verifiability.

PKGBUILD

      1# Maintainer: duanluan <duanluan@outlook.com>
    
      2
    
      3pkgname=wuyou-toolkit
    
      4_pkgname=wuyou-toolkit
    
      5pkgver=0.5.0
    
      6pkgrel=1
    
      7pkgdesc='Native shell for wuyou-toolkit (prebuilt binary)'
    
      8arch=('x86_64')
    
      9url='https://github.com/duanluan/wuyou-toolkit-releases'
    
      10license=('NOASSERTION')
    
      11depends=('gtk3' 'webkit2gtk-4.1')
    
      12provides=("wuyou-toolkit-bin=${pkgver}")
    
      13options=('!strip')
    
      14source=("${_pkgname}_${pkgver}_amd64.deb::https://github.com/duanluan/wuyou-toolkit-releases/releases/download/v${pkgver}/${_pkgname}_${pkgver}_amd64.deb")
    
      15sha256sums=('35721f4d8f60c76a8a938cc75a49f4fadca38cb4fa60b1ca91ca4f99193adb10')
    
      16
    
      17package() {
    
      18  local _extractdir
    
      19  _extractdir="$(mktemp -d)"
    
      20  trap 'rm -rf "${_extractdir}"' EXIT
    
      21
    
      22  bsdtar -C "${_extractdir}" -xf "${srcdir}/${_pkgname}_${pkgver}_amd64.deb"
    
      23  bsdtar -C "${pkgdir}" -xf "${_extractdir}/data.tar.gz"
    
      24
    
      25  sed -i     -e 's/^Name=.*/Name=Wuyou Toolkit/'     -e 's/^Comment=.*/Comment=Cross-platform desktop toolbox/'     -e 's/^Categories=.*/Categories=Utility;Development;/'     "${pkgdir}/usr/share/applications/wuyou-toolkit.desktop"
    
      26}
    
      27

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-21 21:15:20	Medium	2