zentorrent-bin

LOW

maintainer Dominiquini 1 votes scanned 2026-08-31 00:19:57.373659

View on AUR

Why flagged

The package downloads a prebuilt binary from the project's official GitHub release assets, which is a normal and expected practice for -bin packages; the source is trustworthy and matches the project's own infrastructure.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from the project's official GitHub release assets, which is a normal and expected practice for -bin packages; the source is trustworthy and matches the project's own infrastructure.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      2
    
      3_gitauthor=subwaycookiecrunch
    
      4_gitname=zentorrent
    
      5_appname=${_gitname}
    
      6pkgname=${_appname}-bin
    
      7pkgdesc="Just a CLI torrent downloader. No UI, no BS!"
    
      8
    
      9pkgver=4.0.0
    
      10pkgrel=1
    
      11_gitversion=v${pkgver}
    
      12
    
      13arch=('x86_64')
    
      14_barch=('linux-amd64')
    
      15
    
      16_ghurl="https://github.com/${_gitauthor}/${_gitname}"
    
      17_ghurlraw="https://raw.githubusercontent.com/${_gitauthor}/${_gitname}/${_gitversion}"
    
      18url=${_ghurl}
    
      19
    
      20license=('MIT')
    
      21
    
      22provides=("${_appname}")
    
      23conflicts=("${_appname}")
    
      24depends=('glibc' 'libgcc' 'libstdc++')
    
      25
    
      26options=(!strip)
    
      27
    
      28source=("README-${pkgver}.md::${_ghurlraw}/README.md"
    
      29		"LICENSE-${pkgver}::${_ghurlraw}/LICENSE")
    
      30source_x86_64=("${_appname}-${arch[0]}-${pkgver}::${_ghurl}/releases/download/${_gitversion}/${_appname}-${_barch[0]}")
    
      31sha256sums=('4b8b77cd3163f3c6a7329edaee1e04ac48bc83e05b0a97b220319e21654f964c'
    
      32            '5eea9322571742b0584f859e0ee9dfc3958e7d82c597cdc29bff2b623cf07beb')
    
      33sha256sums_x86_64=('dc14e3b8f54da5e1546d991805368b8f9821d2a9da13e66901e032caf2ad1e6f')
    
      34
    
      35
    
      36package() {
    
      37	cd "${srcdir}/" || exit
    
      38
    
      39	install -Dm755 "${_appname}-${CARCH}-${pkgver}" "${pkgdir}/usr/bin/${_appname}"
    
      40
    
      41	install -Dm644 "README-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      42
    
      43	install -Dm644 "LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      44}
    
      45

Changes since previous scan

--- PKGBUILD @ 2026-06-23 04:15
+++ PKGBUILD @ 2026-08-31 00:19
@@ -6,7 +6,7 @@
 pkgname=${_appname}-bin
 pkgdesc="Just a CLI torrent downloader. No UI, no BS!"
 
-pkgver=3.0.0
+pkgver=4.0.0
 pkgrel=1
 _gitversion=v${pkgver}
 
@@ -28,9 +28,9 @@
 source=("README-${pkgver}.md::${_ghurlraw}/README.md"
 		"LICENSE-${pkgver}::${_ghurlraw}/LICENSE")
 source_x86_64=("${_appname}-${arch[0]}-${pkgver}::${_ghurl}/releases/download/${_gitversion}/${_appname}-${_barch[0]}")
-sha256sums=('0b59c86623b0f0126653456773046da420f63cc3f87b37687019710f1b5c4802'
+sha256sums=('4b8b77cd3163f3c6a7329edaee1e04ac48bc83e05b0a97b220319e21654f964c'
             '5eea9322571742b0584f859e0ee9dfc3958e7d82c597cdc29bff2b623cf07beb')
-sha256sums_x86_64=('65e5d7a13b9070d1814a4aaf125a457547d4fff73d0e6bc58fd0ceb2aeb13f3f')
+sha256sums_x86_64=('dc14e3b8f54da5e1546d991805368b8f9821d2a9da13e66901e032caf2ad1e6f')
 
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-31 00:19:57	Low	2
2026-08-30 23:44:22	Medium	1
2026-06-23 04:15:49	Clean	2