yaggui-bin

MEDIUM

maintainer Gear3270 1 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package installs a prebuilt .deb binary from GitHub releases without source availability or build verification, creating a supply-chain risk if the release artifact were compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt .deb binary from GitHub releases without source availability or build verification, creating a supply-chain risk if the release artifact were compromised.

PKGBUILD

      1# Maintainer: SimonVanMello <https://github.com/SimonVanMello>
    
      2# Generated by scripts/aur.mjs in https://github.com/SimonVanMello/yaggui: edit the generator, not this file.
    
      3pkgname=yaggui-bin
    
      4pkgver=0.2.0
    
      5pkgrel=1
    
      6pkgdesc='Fast, cross-platform graphical Git client'
    
      7arch=('x86_64')
    
      8url='https://github.com/SimonVanMello/yaggui'
    
      9license=('GPL-3.0-or-later')
    
      10depends=('git' 'gtk3' 'hicolor-icon-theme' 'webkit2gtk-4.1')
    
      11provides=('yaggui')
    
      12conflicts=('yaggui')
    
      13options=('!debug')
    
      14source=("yaggui-${pkgver}.deb::https://github.com/SimonVanMello/yaggui/releases/download/v${pkgver}/yaggui_${pkgver}_amd64.deb")
    
      15sha256sums=('41cbe947c0fdc533004db798a8b83d2b705a6b565fa0abc191202b996c1ab062')
    
      16
    
      17package() {
    
      18  bsdtar -xf data.tar.* -C "$pkgdir"
    
      19}
    
      20

Changes since previous scan

--- PKGBUILD @ 2026-10-16 00:12
+++ PKGBUILD @ 2026-10-17 00:21
@@ -1,7 +1,7 @@
 # Maintainer: SimonVanMello <https://github.com/SimonVanMello>
 # Generated by scripts/aur.mjs in https://github.com/SimonVanMello/yaggui: edit the generator, not this file.
 pkgname=yaggui-bin
-pkgver=0.1.0
+pkgver=0.2.0
 pkgrel=1
 pkgdesc='Fast, cross-platform graphical Git client'
 arch=('x86_64')
@@ -12,7 +12,7 @@
 conflicts=('yaggui')
 options=('!debug')
 source=("yaggui-${pkgver}.deb::https://github.com/SimonVanMello/yaggui/releases/download/v${pkgver}/yaggui_${pkgver}_amd64.deb")
-sha256sums=('7a0d294ce5cd7201d489f84316a9f79d0ea65f84a4d6bb8a1fa53c0356c10ea3')
+sha256sums=('41cbe947c0fdc533004db798a8b83d2b705a6b565fa0abc191202b996c1ab062')
 
 package() {
   bsdtar -xf data.tar.* -C "$pkgdir"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	2
2026-10-16 15:16:11	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 21:20:28	Medium	2
2026-10-14 15:20:15	Medium	2