3dslicer-git

LOW
maintainer hottea 1 votes scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The source from a non-standard host is an SVG icon from the official project's website, which is non-executable data; the actual code is built from the official GitHub repository, making the risk low.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source from a non-standard host is an SVG icon from the official project's website, which is non-executable data; the actual code is built from the official GitHub repository, making the risk low.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:59 "${_pkgname}.svg::https://www.slicer.org/assets/img/3D-Slicer-Mark.svg"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Butui Hu <hot123tea123@gmail.com>
2
3_pkgname=3dslicer
4pkgname=3dslicer-git
5pkgver=5.12.4.r135.311cf24b61
6pkgrel=1
7pkgdesc='A free, open source and multi-platform software package widely used for medical, biomedical, and related imaging research'
8arch=('x86_64')
9url='https://www.slicer.org'
10license=('BSD-3-Clause')
11depends=(
12 bzip2
13 curl
14 dcmtk
15 fftw
16 glibc
17 hwloc
18 libarchive
19 libffi
20 libglvnd
21 libice
22 libpng
23 libsm
24 libx11
25 libxcrypt
26 libxcursor
27 libxext
28 libxfixes
29 libxrender
30 openssl
31 qt5-base
32 qt5-declarative
33 qt5-location
34 qt5-multimedia
35 qt5-svg
36 qt5-webchannel
37 qt5-webengine
38 qt5-x11extras
39 qt5-xmlpatterns
40 teem
41 util-linux-libs
42 xz
43 zlib
44)
45makedepends=(
46 clang
47 cmake
48 gendesk
49 git
50 ninja
51 qt5-script
52 qt5-tools
53 subversion
54)
55options=(!emptydirs !strip)
56provides=(3dslicer=${pkgver})
57conflicts=(3dslicer)
58source=("${_pkgname}::git+https://github.com/Slicer/Slicer.git"
59 "${_pkgname}.svg::https://www.slicer.org/assets/img/3D-Slicer-Mark.svg"
60 "0001-ENH-Add-pip-target-fallback-for-read-only-site-packages.patch"
61)
62sha512sums=('SKIP'
63 '3422d244f819a7ec4c475d3d8a90c79fcb73738920c0830b100c6342ca24d5be607ba60ee3d91892402036a0adf31d5ab7c8fc83f451121a7b537f7de5306014'
64 '7870c6172dd4af00b9b9cd87a28d224cb8c5360717b98f1fdc2df2bab3bda0a6bcd8530fa0c2b6e25f90a88aa4b5f35cafe79eda77a154abced0fa09e70e0bed'
65)
66
67pkgver() {
68 cd "${srcdir}/${_pkgname}"
69 _max_tag=$(git tag --sort=-v:refname | head -n1)
70 _commit_count=$(git rev-list --count "${_max_tag}"..HEAD)
71 _commit_hash=$(git rev-parse --short HEAD)
72 _max_tag=$(echo "$_max_tag" | sed 's/^v//')
73 _full_version="${_max_tag}.r${_commit_count}.${_commit_hash}"
74 printf "%s" "${_full_version}"
75}
76
77prepare() {
78 echo "Creating desktop file"
79 gendesk -f -n --pkgname ${_pkgname} \
80 --categories "Science;MedicalSoftware;Education;MedicalSoftware" \
81 --exec "Slicer" \
82 --icon "${_pkgname}" \
83 --pkgdesc "${pkgdesc}" \
84 --startupnotify \
85 --custom="StartupWMClass=Slicer"
86 patch -d ${_pkgname} -p1 -i ${srcdir}/0001-ENH-Add-pip-target-fallback-for-read-only-site-packages.patch
87}
88
89build() {
90 export CC=clang
91 export CXX=clang++
92 cmake \
93 -B "${srcdir}/build" \
94 -DBUILD_TESTING=OFF \
95 -DCMAKE_BUILD_TYPE=Release \
96 -DCMAKE_INSTALL_PREFIX=/usr \
97 -DSlicer_BUILD_DOCUMENTATION=OFF \
98 -DSlicer_BUILD_I18N_SUPPORT=ON \
99 -DSlicer_BUILD_PARAMETERSERIALIZER_SUPPORT=OFF \
100 -DSlicer_REQUIRED_QT_VERSION=5 \
101 -DSlicer_STORE_SETTINGS_IN_APPLICATION_HOME_DIR=OFF \
102 -DSlicer_USE_GIT_PROTOCOL=OFF \
103 -DSlicer_USE_PYTHONQT=ON \
104 -DSlicer_USE_SYSTEM_bzip2=ON \
105 -DSlicer_USE_SYSTEM_CTK=OFF \
106 -DSlicer_USE_SYSTEM_CTKAPPLAUNCHER=OFF \
107 -DSlicer_USE_SYSTEM_CTKAppLauncherLib=OFF \
108 -DSlicer_USE_SYSTEM_curl=ON \
109 -DSlicer_USE_SYSTEM_DCMTK=ON \
110 -DSlicer_USE_SYSTEM_ITK=OFF \
111 -DSlicer_USE_SYSTEM_JsonCpp=OFF \
112 -DSlicer_USE_SYSTEM_LibArchive=ON \
113 -DSlicer_USE_SYSTEM_LibFFI=ON \
114 -DSlicer_USE_SYSTEM_LZMA=ON \
115 -DSlicer_USE_SYSTEM_OpenSSL=ON \
116 -DSlicer_USE_SYSTEM_ParameterSerializer=OFF \
117 -DSlicer_USE_SYSTEM_python=OFF \
118 -DSlicer_USE_SYSTEM_qRestAPI=OFF \
119 -DSlicer_USE_SYSTEM_QT=ON \
120 -DSlicer_USE_SYSTEM_RapidJSON=OFF \
121 -DSlicer_USE_SYSTEM_SlicerExecutionModel=OFF \
122 -DSlicer_USE_SYSTEM_sqlite=OFF \
123 -DSlicer_USE_SYSTEM_tbb=OFF \
124 -DSlicer_USE_SYSTEM_teem=ON \
125 -DSlicer_USE_SYSTEM_VTK=OFF \
126 -DSlicer_USE_SYSTEM_zlib=ON \
127 -GNinja \
128 -S "${srcdir}/${_pkgname}" \
129 -Wno-dev
130 cmake --build "${srcdir}/build"
131}
132
133package() {
134 cmake --build "${srcdir}/build/Slicer-build" --target package
135 install -d "${pkgdir}/opt/${_pkgname}" "${pkgdir}/usr/bin"
136 tar xvf "${srcdir}/build/Slicer-build/"*.tar.gz -C "${pkgdir}/opt/${_pkgname}" --strip-components 1
137 ln -s /opt/${_pkgname}/Slicer "${pkgdir}/usr/bin/Slicer"
138 install -Dm644 "${srcdir}/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
139 install -Dm644 "${srcdir}/${_pkgname}.svg" "${pkgdir}/usr/share/pixmaps/${_pkgname}.svg"
140}
141# vim:set ts=2 sw=2 et:
142

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Low 2
2026-10-31 00:07:41 Low 2
2026-10-30 00:29:30 Low 2
2026-10-29 00:13:55 Low 2
2026-10-28 00:06:54 Low 2
2026-10-27 00:23:28 Low 2
2026-10-26 00:12:40 Low 2
2026-10-25 00:20:48 Low 2
2026-10-24 00:14:55 Low 2
2026-10-23 00:02:19 Low 2
2026-10-22 00:13:10 Low 2
2026-10-21 00:12:50 Low 2
2026-10-20 00:10:31 Low 2
2026-10-19 00:03:55 Low 2
2026-10-18 00:06:55 Low 2
2026-10-17 00:21:55 Low 2
2026-10-16 00:12:47 Low 2
2026-10-15 00:28:05 Low 2
2026-10-14 00:06:47 Low 2
2026-10-13 00:23:45 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion