zuno-bin

maintainer 9M2PJU · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt binary from a non-whitelisted but project-owned GitHub release; while the source is verifiable and checksummed, distributing a prebuilt .deb from an unofficial third party introduces a supply-chain risk if the upstream binary is compromised.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a non-whitelisted but project-owned GitHub release; while the source is verifiable and checksummed, distributing a prebuilt .deb from an unofficial third party introduces a supply-chain risk if the upstream binary is compromised.

PKGBUILD

      1# Maintainer: 9M2PJU <9m2pju@gmail.com>
    
      2# Contributor: 9M2PJU <9m2pju@gmail.com>
    
      3
    
      4pkgname=zuno-bin
    
      5pkgver=1.2.1
    
      6pkgrel=1
    
      7pkgdesc="Desktop YouTube Music client built with Tauri (prebuilt binary from upstream releases)"
    
      8arch=('x86_64')
    
      9url="https://github.com/noFAYZ/zuno"
    
      10license=('Apache-2.0')
    
      11depends=(
    
      12  'webkit2gtk-4.1'
    
      13  'gtk3'
    
      14  'libsoup3'
    
      15  'libayatana-appindicator'
    
      16  'glib2'
    
      17  'cairo'
    
      18  'pango'
    
      19  'gdk-pixbuf2'
    
      20  'fontconfig'
    
      21  'freetype2'
    
      22  'hicolor-icon-theme'
    
      23  'desktop-file-utils'
    
      24)
    
      25provides=('zuno')
    
      26conflicts=('zuno' 'zuno-git')
    
      27options=('!strip' '!emptydirs')
    
      28source_x86_64=("Zuno_${pkgver}_amd64.deb::${url}/releases/download/v${pkgver}/Zuno_${pkgver}_amd64.deb")
    
      29sha256sums_x86_64=('3abc57c1accaaf3ef68a0aa37d3b9e6e81ad9ae1a5a8216a739efeb8578c05da')
    
      30noextract=("Zuno_${pkgver}_amd64.deb")
    
      31
    
      32package() {
    
      33    cd "${srcdir}"
    
      34
    
      35    local deb="Zuno_${pkgver}_amd64.deb"
    
      36    ar x "${deb}"
    
      37
    
      38    tar -xzf data.tar.gz -C "${pkgdir}"
    
      39
    
      40    # Fix permissions
    
      41    find "${pkgdir}" -type d -exec chmod 755 {} +
    
      42
    
      43    # Desktop file lives under usr/share/applications/Zuno.desktop; rename to lowercase for consistency
    
      44    if [[ -f "${pkgdir}/usr/share/applications/Zuno.desktop" ]]; then
    
      45        mv "${pkgdir}/usr/share/applications/Zuno.desktop" \
    
      46           "${pkgdir}/usr/share/applications/zuno.desktop"
    
      47    fi
    
      48}
    
      49

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 15:15:12	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 15:12:02	MEDIUM	2