aseprite

maintainer ImperatorStorm · 143 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from source hosted on GitHub and Chromium's official repositories, which are legitimate project sources; the non-standard host refers to a tagged release on GitHub, which is normal for AUR packages and poses no significant risk.

Triggered rules

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source hosted on GitHub and Chromium's official repositories, which are legitimate project sources; the non-standard host refers to a tagged release on GitHub, which is normal for AUR packages and poses no significant risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:48 skia-$_skiaver-icu::git+https://chromium.googlesource.com/chromium/deps/icu.git#commit=a0718d4f121727e30b8d52c7a189ebf5ab52421f

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Imperator Storm <ImperatorStorm11@protonmail.com>
    
      2# Maintainer: Eldred Habert <me@eldred.fr>
    
      3# Contributor: Fredrick Brennan <copypaste@kittens.ph>
    
      4# Contributor: Andrew Bueide <abueide@protonmail.com>
    
      5# Contributor: rouhannb <rouhannb@protonmail.com>
    
      6# Contributor: Wilson E. Alvarez <wilson.e.alvarez1@gmail.com>
    
      7# Contributor: Benoit Favre <benoit.favre@gmail.com>
    
      8# Contributor: Alexander Rødseth <rodseth@gmail.com>
    
      9# Contributor: Kamil Biduś <kamil.bidus@gmail.com>
    
      10# Contributor: Jomar Milan <jomarm@jomarm.com>
    
      11
    
      12pkgname=aseprite
    
      13pkgver=1.3.18.1
    
      14_skiaver=m124
    
      15_skiahash=08a5439a6b
    
      16pkgrel=3
    
      17pkgdesc='Create animated sprites and pixel art'
    
      18arch=('x86_64')
    
      19url="https://www.aseprite.org/"
    
      20license=('LicenseRef-Aseprite-EULA')
    
      21depends=(# ~ Aseprite's direct dependencies ~
    
       # pixman is not linked to because we use Skia instead
    
       # harfbuzz is linked statically because Aseprite expects an older version
    
       cmark curl giflib libjpeg-turbo zlib libpng 'tinyxml2>=11.0.0' freetype2
    
       libwebp libarchive fmt libglvnd
    
       # ~ Skia deps ~
    
       # (Skia links dynamically to HarfBuzz, only Aseprite itself doesn't. >_<)
    
       expat harfbuzz libgl
    
       # Already required by Aseprite: libjpeg-turbo libpng zlib freetype2
    
 hicolor-icon-theme # For installing Aseprite's icons
    
       # These two are only reported by Namcap, but don't seem to be direct dependencies?
    
       fontconfig libxcursor
    
       # Required Dependency
    
       libxrandr)
    
      35makedepends=(# "Meta" dependencies
    
           cmake ninja git python
    
           # Aseprite (including e.g. LAF)
    
           libxi
    
           # Skia
    
           gn harfbuzz-icu
    
           # Upstream recommends using clang
    
           'clang>=22')
    
      43source=("https://github.com/aseprite/aseprite/releases/download/v$pkgver/Aseprite-v$pkgver-Source.zip"
    
      # Which branch a given build of Aseprite requires is noted in its `INSTALL.md`
    
      "skia-$_skiaver.tar.gz::https://github.com/aseprite/skia/archive/refs/tags/$_skiaver-$_skiahash.tar.gz"
    
      # forgive me, I couldn't figure out linker errors.
    
      # update commit with skia
    
      skia-$_skiaver-icu::git+https://chromium.googlesource.com/chromium/deps/icu.git#commit=a0718d4f121727e30b8d52c7a189ebf5ab52421f
    
aseprite-strings::git+https://github.com/aseprite/strings.git#commit=417074f649f359f98511fc87a707c276d87f5739
    
      desktop.patch
    
      shared-fmt.patch
    
      # Based on https://patch-diff.githubusercontent.com/raw/aseprite/aseprite/pull/2535.patch
    
      shared-libarchive.patch
    
      # Based on https://patch-diff.githubusercontent.com/raw/aseprite/aseprite/pull/2523.patch
    
      shared-libwebp.patch
    
      shared-skia-deps.patch
    
      optional-pixman.patch
    
      fix-shared-tinyxml2.patch
    
      shared-libwebp-found.patch
    
      include_cstdint.patch
    
      shared_libjpeg-turbo.patch
    
      change_use_of_removed_intrinsic.patch
    
      fmt-12.2.0-include-format.patch)
    
      64noextract=("Aseprite-v$pkgver-Source.zip"
    
         "skia-$_skiaver.tar.gz") # Don't extract Aseprite or skia sources at the root
    
      66sha256sums=('438e7a1571990383beca761eca829402f14f225e164730eb2edc71b2e9566e58'
    
          'c2a567d6b8bb933a92615cbdee0de268d02c3a06863337ee8822eedab9ed66ba'
    
          'b52f179a687ef2f91a52b696ab6581f4a37df5e88cb22040fa1ec6567cf0ebb1'
    
          '883d1b25014deded64c3baa8e680dc3e2e486ca7b9c9116015c3cc557c2af781'
    
          '8b14e36939e930de581e95abf0591645aa0fcfd47161cf88b062917dbaaef7f9'
    
          'c3591d376180d99ff8001c3d549c0bd18ef5e4d95f1755ccaa8e2fd65dd5d2b3'
    
          '96d75ecc951712e80734f476511658fcc3c91fc1655fe9a01453c3fc8c2a9274'
    
          '0f8adb959d7000697af453d6cf5aaf9984b74868008382aad541d2c29871c751'
    
          'eb9f544e68b41b5cb1a9ab7a6648db51587e67e94f1a452cb5a84f3d224bf5d0'
    
          'c2d14f9738a96a9db3695c00ac3d14b1312b6a595b151bd56e19422c86517654'
    
          'ba02fc060dc930cfd66a8903a5d8a59f981753bdf416e91cc77a48c56c86aea3'
    
          '72605d6760c29eb98f2d8d8cf2cc9f9f7d7655bcf7cfc944f6a46b0957adbb14'
    
          '3381038fc5209600428801fa0b2b05ddee031b0926eaa75c114172e503916cd5'
    
          '0fa67d34f63cb4ed472b620ebad0656aeca646cb7f1069b7066ee91e6902fe6c'
    
          '1276dd96f9ba63ce942b7321f5f753b02119c99b2eaf652ea5998b90d5d5a1d2'
    
          'de5762bd0913eb4d27c91d79dca2b2c216c7b53b7ac20b6c653fa96e7823f154')
    
      82_debug="true"
    
      83prepare() {
    
# Extract Aseprite's sources
    
mkdir -p aseprite
    
bsdtar -xf "${noextract[0]}" -C aseprite
    
# Extract Skia's sources
    
mkdir -p skia
    
bsdtar xf skia-$_skiaver.tar.gz  --strip-components=1 -C skia
    
# link to skia's icu
    
mkdir -p skia/third_party/externals/
    
ln -fs $srcdir/skia-$_skiaver-icu skia/third_party/externals/icu
    
# Fix up Aseprite's desktop integration
    
[[ -n $_debug ]] && echo desktop.patch
    
env -C aseprite patch -tp1 <desktop.patch
    
# Allow using more shared libs
    
[[ -n $_debug ]] && echo shared-fmt.patch
    
env -C aseprite patch -tp1 <shared-fmt.patch
    
[[ -n $_debug ]] && echo shared-libarchive.patch
    
env -C aseprite patch -tp1 <shared-libarchive.patch
    
[[ -n $_debug ]] && echo shared-libwebp.patch
    
env -C aseprite patch -tp1 <shared-libwebp.patch
    
[[ -n $_debug ]] && echo shared-pixman.patch
    
env -C aseprite patch -tp1 <optional-pixman.patch
    
# Their "FindSkia" module forcefully tries to use Skia's FreeType and HarfBuzz,
    
# but we don't clone those because we use the shared ones. Avoid overwriting the settings instead.
    
[[ -n $_debug ]] && echo shared-skia-deps.patch
    
env -C aseprite patch -tp1 <shared-skia-deps.patch
    
# TinyEXIF cannot find tinyxml2 otherwise
    
[[ -n $_debug ]] && echo fix-shared-tinyxml2.patch
    
env -C aseprite/third_party/TinyEXIF patch -tp1 <fix-shared-tinyxml2.patch
    
[[ -n $_debug ]] && echo shared-libwebp-found.patch
    
env -C aseprite patch -tp1 <shared-libwebp-found.patch
    
[[ -n $_debug ]] && echo shared_libjpeg-turbo.patch
    
env -C aseprite patch -tp1 <shared_libjpeg-turbo.patch
    
[[ -n $_debug ]] && echo include_cstdint.patch
    
patch -tp1 <include_cstdint.patch
    
[[ -n $_debug ]] && echo change_use_of_removed_intrinsic.patch
    
env -C skia/modules/skcms patch -tp1 <change_use_of_removed_intrinsic.patch
    
env -C aseprite patch -tp1 <fmt-12.2.0-include-format.patch
    
      121}
    
      122
    
      123build() {
    
echo Building Skia...
    
local _skiadir="$PWD/skia/obj"
    
export CXX=clang++
    
export CC=clang
    
export CXXFLAGS+=" -std=c++11 -stdlib=libstdc++"
    
export AR=ar
    
export NM=nm
    
# Flags can be found by running `gn args --list "$_skiadir"` from skia's directory.
    
# (Pipe the output somewhere, there's a LOT of args.)
    
#
    
# The flags are chosen to provide the API required by Aseprite and nothing else (if possible),
    
# so as to reduce the compilation time and final binary size.
    
#
    
# Individual rationales:
    
#   is_official_build: Suggested by the build instructions.
    
#   skia_build_fuzzers: We don't care about them.
    
#   skia_enable_pdf: Not used by Aseprite.
    
#   skia_enable_skottie: Not used by Aseprite.
    
#   skia_use_lib*_{encode,decode}: Aseprite only loads PNG assets, so only libpng is required.
    
#   skia_use_expat: Only required for the Android font manager and SVGCanvas/SVGDevice.
    
#   skia_use_piex: Not used by Aseprite. Only used for reading RAW files.
    
#   skia_use_xps: Not used outside of Windows.
    
#   skia_use_zlib: Only used for PDF and RAW files.
    
#   skia_enable_skparagraph: Aseprite does not link against this library.
    
#   skia_use_system_icu: Aseprite wants an `icudtl.dat`, which would require pulling a 1GiB git repo
    
#                        as a dependency
    
      150
    
# gn is bad software
    
env -C skia gn gen "$_skiadir" --args='is_official_build=true skia_build_fuzzers=false skia_enable_pdf=false skia_enable_skottie=false skia_enable_svg=false skia_use_libjpeg_turbo_encode=false skia_use_libjpeg_turbo_decode=false skia_use_libwebp_encode=false skia_use_libwebp_decode=false skia_use_expat=false skia_use_piex=false skia_use_xps=false skia_use_zlib=false skia_enable_skparagraph=false skia_use_wuffs=false skia_use_system_icu=false cc="clang" cxx="clang++"'
    
ninja -C "$_skiadir" skia modules
    
echo Building Aseprite...
    
# Suppress install messages since we install to a temporary area; `install -v` will do the job
    
cmake -S aseprite -B build -G Ninja -Wno-dev -DCMAKE_INSTALL_MESSAGE=NEVER -DCMAKE_BUILD_TYPE=None \
    
      157-DENABLE_UPDATER=OFF -DENABLE_{SCRIPTING,WEBSOCKET}=ON \
    
      158-DLAF_WITH_{EXAMPLES,TESTS}=OFF -DLAF_BACKEND=skia \
    
      159-DSKIA_DIR="$PWD/skia" -DSKIA_LIBRARY_DIR="$_skiadir" \
    
      160-DCMAKE_AR=$(command -v ar) -DCMAKE_RANLIB=$(command -v ranlib) \
    
      161-DUSE_SHARED_{CMARK,CURL,FMT,GIFLIB,LIBJPEG_TURBO,ZLIB,LIBPNG,TINYXML,PIXMAN,FREETYPE,HARFBUZZ,LIBARCHIVE,WEBP}=ON \
    
      162-DCMAKE_POLICY_VERSION_MINIMUM=3.5 # workaround
    
cmake --build build
    
      164}
    
      165
    
      166check() {
    
export CXX=clang++
    
export CC=clang
    
export CXXFLAGS+=" -std=c++11 -stdlib=libstdc++"
    
export AR=ar
    
export NM=nm
    
env -C build ctest --output-on-failure
    
      173}
    
      174
    
      175package() {
    
depends+=(libcurl.so libgif.so libjpeg.so libfreetype.so libarchive.so libfmt.so
    
	  libwebp.so libwebpmux.so libwebpdemux.so libjpeg.so libexpat.so=1-64 libharfbuzz.so=0-64
    
	  libfontconfig.so)
    
export CXX=clang++
    
export CC=clang
    
export CXXFLAGS+=" -std=c++11 -stdlib=libstdc++"
    
export AR=ar
    
export NM=nm
    
# Now the fun part: components of e.g. `libwebp` get installed as well,
    
# since we've had to compile it. But we don't want them.
    
# So, install normally, and then cherry-pick Aseprite's files out of that.
    
# Use a whitelist to prefer installing not enough (breakage goes noticed),
    
# instead of too much (cruft rarely goes noticed). Also hope that it doesn't break :)
    
cmake --install build --prefix=staging --strip
    
      190
    
# Install the binary and its `.desktop` file
    
install -vDm 755 staging/bin/aseprite "$pkgdir/usr/bin/aseprite"
    
install -vDm 644 aseprite/src/desktop/linux/aseprite.desktop "$pkgdir/usr/share/applications/$pkgname.desktop"
    
install -vDm 644 aseprite/src/desktop/linux/mime/aseprite.xml "$pkgdir/usr/share/mime/packages/$pkgname.xml"
    
# Thumbnailer
    
install -vDm 755 aseprite/src/desktop/linux/aseprite-thumbnailer "$pkgdir/usr/bin/aseprite-thumbnailer"
    
install -vDm 644 aseprite/src/desktop/linux/gnome/aseprite.thumbnailer "$pkgdir/usr/share/thumbnailers/aseprite.thumbnailer"
    
# Install the icons in the correct directory (which is not the default)
    
local _size
    
for _size in 16 32 48 64 128 256; do
    
# The installed icon's name is taken from the `.desktop` file
    
install -vDm 644 staging/share/aseprite/data/icons/ase$_size.png "$pkgdir/usr/share/icons/hicolor/${_size}x$_size/apps/aseprite.png"
    
done
    
# Delete the icons to avoid copying them in two places (they aren't used by Aseprite itself)
    
rm -rf staging/share/aseprite/data/icons
    
# Install all of the program's data
    
cp -vrt "$pkgdir/usr/share" staging/share/aseprite
    
# Also install the licenses
    
install -vDm 644 -t "$pkgdir/usr/share/licenses/$pkgname" aseprite/{EULA.txt,docs/LICENSES.md}
    
# Copy the font's license, but leave it in the font directory as well (probably doesn't hurt)
    
install -vm 644 aseprite/data/fonts/LICENSE.txt "$pkgdir/usr/share/licenses/$pkgname/font.txt"
    
# Copy translations
    
mkdir -p "$pkgdir/usr/share/$pkgname/data/strings/"
    
cp -vt "$pkgdir/usr/share/$pkgname/data/strings/" aseprite-strings/*.ini
    
# Copy translations' license
    
install -vm 644 aseprite-strings/LICENSE.txt "$pkgdir/usr/share/licenses/$pkgname/translations.txt"
    
      217}
    
      218

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -13,7 +13,7 @@
 pkgver=1.3.18.1
 _skiaver=m124
 _skiahash=08a5439a6b
-pkgrel=1
+pkgrel=3
 pkgdesc='Create animated sprites and pixel art'
 arch=('x86_64')
 url="https://www.aseprite.org/"
@@ -157,6 +157,7 @@
 -DENABLE_UPDATER=OFF -DENABLE_{SCRIPTING,WEBSOCKET}=ON \
 -DLAF_WITH_{EXAMPLES,TESTS}=OFF -DLAF_BACKEND=skia \
 -DSKIA_DIR="$PWD/skia" -DSKIA_LIBRARY_DIR="$_skiadir" \
+-DCMAKE_AR=$(command -v ar) -DCMAKE_RANLIB=$(command -v ranlib) \
 -DUSE_SHARED_{CMARK,CURL,FMT,GIFLIB,LIBJPEG_TURBO,ZLIB,LIBPNG,TINYXML,PIXMAN,FREETYPE,HARFBUZZ,LIBARCHIVE,WEBP}=ON \
 -DCMAKE_POLICY_VERSION_MINIMUM=3.5 # workaround
 	cmake --build build

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 19:18:43	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 05:27:22	LOW	2
2026-06-27 20:30:17	CLEAN	2
2026-06-19 19:07:35	CLEAN	2
2026-06-18 16:11:54	LOW	1