butt
LOW
maintainer dtcooper
14 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The source is a tarball from the project's official domain, used to build the software from source; the non-whitelisted host is the project's own site, so the risk is low despite the static analysis flag.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the project's official domain, used to build the software from source; the non-whitelisted host is the project's own site, so the risk is low despite the static analysis flag.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:15
source=("${pkgname}-${pkgver}.tar.gz::https://danielnoethen.de/${pkgname}/release/${pkgver}/${pkgname}-${pkgver}.tar.gz")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: linuxer <linuxer@artixlinux.org>
2
# Maintainer: Josef Miegl <josef@miegl.cz>
3
# Maintainer: David Cooper (dtcooper) <david@dtcooper.com>
4
# Contributor: goll <adrian.goll+aur[at]gmail>
5
# Contributor: Kosava <kosava@gmail.com>
6
7
pkgname=butt
8
pkgver=1.47.0
9
pkgrel=1
10
pkgdesc="Easy to use, multi OS streaming tool"
11
arch=('i686' 'x86_64' 'aarch64' 'armv7h')
12
license=('GPL2')
13
url="https://danielnoethen.de/butt/"
14
depends=('fltk' 'dbus' 'portaudio' 'portmidi' 'libfdk-aac' 'libvorbis' 'libogg' 'lame' 'flac' 'opus' 'libsamplerate' 'libdatachannel')
15
source=("${pkgname}-${pkgver}.tar.gz::https://danielnoethen.de/${pkgname}/release/${pkgver}/${pkgname}-${pkgver}.tar.gz")
16
sha256sums=('d7b3a8bbbe011c337cf93c6a683071210cc39e0277f77482f94532becf126760')
17
18
build() {
19
cd "${pkgname}-${pkgver}"
20
21
# Replacing _FORTIFY_SOURCE here fixes build warnings
22
./configure --with-client --enable-webrtc --prefix=/usr \
23
CFLAGS="${CFLAGS/_FORTIFY_SOURCE=?/_FORTIFY_SOURCE=2}" \
24
CXXFLAGS="${CXXFLAGS/_FORTIFY_SOURCE=?/_FORTIFY_SOURCE=2}"
25
26
make
27
}
28
29
package() {
30
cd "${pkgname}-${pkgver}"
31
make DESTDIR="${pkgdir}" install
32
33
# Desktop file
34
install -Dm644 "usr/share/applications/${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
35
36
# Icons
37
for size in 16 22 24 32 48 64 96 128 256 512; do
38
format="${size}x${size}"
39
install -Dm644 "icons/icon_${format}.png" "${pkgdir}/usr/share/icons/hicolor/${format}/apps/${pkgname}.png"
40
done
41
42
install -Dm644 "icons/icon_scalable.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/${pkgname}.svg"
43
44
# Documentation
45
for doc in AUTHORS ChangeLog COPYING KNOWN_BUGS NEWS README THANKS; do
46
install -Dm644 "${doc}" "${pkgdir}/usr/share/doc/${pkgname}/${doc}"
47
done
48
install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}"
49
ln -s "/usr/share/doc/${pkgname}/COPYING" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
50
51
# Pixmaps
52
for file in usr/share/pixmaps/"${pkgname}"*; do
53
filename="$(basename "${file}")"
54
install -Dm644 "${file}" "${pkgdir}/usr/share/pixmaps/${filename}"
55
done
56
}
57
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |