choir-overlay

maintainer CraftyCorvid · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged All sources are fetched from legitimate, project-owned or well-known hosts (GitHub project repo, ocornut/imgui, nlohmann/json, wrapdb.mesonbuild.com) with SHA256 checksums; the package builds from source using meson with no obfuscated payloads, remote code execution, or exfiltration; the only mild concern is low vote count on a recently uploaded package, which is normal for new AUR submissions.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): All sources are fetched from legitimate, project-owned or well-known hosts (GitHub project repo, ocornut/imgui, nlohmann/json, wrapdb.mesonbuild.com) with SHA256 checksums; the package builds from source using meson with no obfuscated payloads, remote code execution, or exfiltration; the only mild concern is low vote count on a recently uploaded package, which is normal for new AUR submissions.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 "imgui_1.92.5-1_patch.zip::https://wrapdb.mesonbuild.com/v2/imgui_1.92.5-1/get_patch"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: craftycorvid <me@ivanff.com>
    
      2#
    
      3# AUR release package: builds Choir from a tagged GitHub release tarball.
    
      4# (For the latest commit on main instead, see the choir-overlay-git package.)
    
      5pkgname=choir-overlay
    
      6pkgver=1.1.0
    
      7pkgrel=1
    
      8pkgdesc="Discord voice overlay for Vulkan + OpenGL games (not affiliated with Discord Inc.)"
    
      9arch=('x86_64')
    
      10url="https://github.com/craftycorvid/choir-overlay"
    
      11license=('MIT')
    
      12depends=('qt6-base' 'qt6-svg' 'vulkan-icd-loader' 'libglvnd')
    
      13makedepends=('meson' 'vulkan-headers')
    
      14conflicts=('choir-overlay-git')
    
      15# Only the .wrap files are committed upstream, so the release tarball carries no Dear ImGui
    
      16# or nlohmann/json sources. Fetch those wrap downloads here (checksummed by makepkg) and
    
      17# pre-seed meson's packagecache in prepare(), so build() resolves them with no network.
    
      18source=(
    
      19  "$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
    
      20  "imgui-1.92.5.tar.gz::https://github.com/ocornut/imgui/archive/refs/tags/v1.92.5.tar.gz"
    
      21  "imgui_1.92.5-1_patch.zip::https://wrapdb.mesonbuild.com/v2/imgui_1.92.5-1/get_patch"
    
      22  "nlohmann_json-3.12.0.zip::https://github.com/nlohmann/json/releases/download/v3.12.0/include.zip"
    
      23)
    
      24noextract=(
    
      25  'imgui-1.92.5.tar.gz'
    
      26  'imgui_1.92.5-1_patch.zip'
    
      27  'nlohmann_json-3.12.0.zip'
    
      28)
    
      29sha256sums=(
    
      30  'a6803fc0a0bb1eb0ba42eef9b347f02286ced5a501c2eb302e84fbeed89ae73b'
    
      31  '0eb50fe9aeba1a51f96b5843c7f630a32ed2e9362d693c61b87e4fa870cf826d'
    
      32  '636e9099a55869f25a95739b345e844c6b42166a0a0d22837ffbedd8e7af0bce'
    
      33  'b8cb0ef2dd7f57f18933997c9934bb1fa962594f701cd5a8d3c2c80541559372'
    
      34)
    
      35
    
      36prepare() {
    
      37  # meson looks here (by the wrap's source_filename/patch_filename) before downloading.
    
      38  mkdir -p "$srcdir/choir-overlay-$pkgver/subprojects/packagecache"
    
      39  cp -t "$srcdir/choir-overlay-$pkgver/subprojects/packagecache/" \
    
      40    "$srcdir/imgui-1.92.5.tar.gz" \
    
      41    "$srcdir/imgui_1.92.5-1_patch.zip" \
    
      42    "$srcdir/nlohmann_json-3.12.0.zip"
    
      43}
    
      44
    
      45build() {
    
      46  meson setup "$srcdir/build" "$srcdir/choir-overlay-$pkgver" \
    
      47    --prefix=/usr --buildtype=release -Dbuild_tests=false
    
      48  meson compile -C "$srcdir/build"
    
      49}
    
      50
    
      51package() {
    
      52  DESTDIR="$pkgdir" meson install -C "$srcdir/build"
    
      53  # imgui is linked statically into libchoir_overlay.so; the wrap also installs its
    
      54  # build-time libimgui.a — drop it (useless at runtime, namcap flags stray static libs).
    
      55  rm -f "$pkgdir/usr/lib/libimgui.a"
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	3
2026-08-17 00:18:29	LOW	3
2026-08-16 00:03:42	LOW	3
2026-08-15 00:26:13	LOW	3
2026-08-14 00:03:41	LOW	3
2026-08-13 19:29:52	LOW	3
2026-08-13 19:26:43	MEDIUM	2