your-szu-life-bin

LOW

maintainer Rinne 0 votes scanned 2026-10-24 13:40:12.894744

View on AUR

Why flagged

The package installs a prebuilt .deb from the project's official GitHub releases, which is unpacked and installed directly; while the binary is not built from source, it comes from a trusted project host and no malicious behavior is evident.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt .deb from the project's official GitHub releases, which is unpacked and installed directly; while the binary is not built from source, it comes from a trusted project host and no malicious behavior is evident.

PKGBUILD

      1# Maintainer: Rinne <aur@rinne.in>
    
      2pkgname=your-szu-life-bin
    
      3pkgver=0.10.0
    
      4pkgrel=2
    
      5pkgdesc="泥深 - 你的SZU助手"
    
      6arch=('x86_64')
    
      7url='https://github.com/rinnein/your-szu-life'
    
      8license=('MIT')
    
      9depends=('libayatana-appindicator' 'webkit2gtk-4.1' 'gtk3' 'aria2')
    
      10provides=('your-szu-life')
    
      11conflicts=('your-szu-life-git' 'your-szu-life')
    
      12options=('!strip' '!debug')
    
      13
    
      14_debname="your-szu-life_linux_x64_0.10.0-release.deb"
    
      15source_x86_64=("${_debname}::https://github.com/rinnein/your-szu-life/releases/download/canary/your-szu-life_linux_x64_0.10.0-release.deb")
    
      16sha256sums_x86_64=('20fe986930b25fa290fa2e59cec678be170d1eb0a4829567967648fea884d1d1')
    
      17
    
      18package() {
    
      19  cd "${srcdir}"
    
      20  # A .deb is an ar archive holding control.tar.* and data.tar.*. makepkg does
    
      21  # not unpack it, so the payload is extracted explicitly and installed as-is.
    
      22  local inner
    
      23  inner=$(bsdtar -tf "${_debname}" | grep -E '^data\.tar\.')
    
      24  if [[ -z "${inner}" ]]; then
    
      25    error "no data.tar.* inside ${_debname}"
    
      26    return 1
    
      27  fi
    
      28  bsdtar -xf "${_debname}" "${inner}"
    
      29  bsdtar -xf "${inner}" -C "${pkgdir}"
    
      30  # Drop the bundled aria2c: it collides with the aria2 package and needs a
    
      31  # libaria2.so.0 that this package does not ship.
    
      32  rm -f "${pkgdir}/usr/bin/aria2c"
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-24 13:40:12	Low	2