butt
LOW
maintainer dtcooper
14 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The source is a tarball from the project's official domain, used to build the software from source; the non-whitelisted host is the project's own site, so the risk is low despite the static analysis flag.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the project's official domain, used to build the software from source; the non-whitelisted host is the project's own site, so the risk is low despite the static analysis flag.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:15
source=("${pkgname}-${pkgver}.tar.gz::https://danielnoethen.de/${pkgname}/release/${pkgver}/${pkgname}-${pkgver}.tar.gz")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: linuxer <linuxer@artixlinux.org>
2
# Maintainer: Josef Miegl <josef@miegl.cz>
3
# Maintainer: David Cooper (dtcooper) <david@dtcooper.com>
4
# Contributor: goll <adrian.goll+aur[at]gmail>
5
# Contributor: Kosava <kosava@gmail.com>
6
7
pkgname=butt
8
pkgver=1.47.0
9
pkgrel=1
10
pkgdesc="Easy to use, multi OS streaming tool"
11
arch=('i686' 'x86_64' 'aarch64' 'armv7h')
12
license=('GPL2')
13
url="https://danielnoethen.de/butt/"
14
depends=('fltk' 'dbus' 'portaudio' 'portmidi' 'libfdk-aac' 'libvorbis' 'libogg' 'lame' 'flac' 'opus' 'libsamplerate' 'libdatachannel')
15
source=("${pkgname}-${pkgver}.tar.gz::https://danielnoethen.de/${pkgname}/release/${pkgver}/${pkgname}-${pkgver}.tar.gz")
16
sha256sums=('d7b3a8bbbe011c337cf93c6a683071210cc39e0277f77482f94532becf126760')
17
18
build() {
19
cd "${pkgname}-${pkgver}"
20
21
# Replacing _FORTIFY_SOURCE here fixes build warnings
22
./configure --with-client --enable-webrtc --prefix=/usr \
23
CFLAGS="${CFLAGS/_FORTIFY_SOURCE=?/_FORTIFY_SOURCE=2}" \
24
CXXFLAGS="${CXXFLAGS/_FORTIFY_SOURCE=?/_FORTIFY_SOURCE=2}"
25
26
make
27
}
28
29
package() {
30
cd "${pkgname}-${pkgver}"
31
make DESTDIR="${pkgdir}" install
32
33
# Desktop file
34
install -Dm644 "usr/share/applications/${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
35
36
# Icons
37
for size in 16 22 24 32 48 64 96 128 256 512; do
38
format="${size}x${size}"
39
install -Dm644 "icons/icon_${format}.png" "${pkgdir}/usr/share/icons/hicolor/${format}/apps/${pkgname}.png"
40
done
41
42
install -Dm644 "icons/icon_scalable.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/${pkgname}.svg"
43
44
# Documentation
45
for doc in AUTHORS ChangeLog COPYING KNOWN_BUGS NEWS README THANKS; do
46
install -Dm644 "${doc}" "${pkgdir}/usr/share/doc/${pkgname}/${doc}"
47
done
48
install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}"
49
ln -s "/usr/share/doc/${pkgname}/COPYING" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
50
51
# Pixmaps
52
for file in usr/share/pixmaps/"${pkgname}"*; do
53
filename="$(basename "${file}")"
54
install -Dm644 "${file}" "${pkgdir}/usr/share/pixmaps/${filename}"
55
done
56
}
57
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |