choir-overlay-git

maintainer CraftyCorvid · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package downloads source code from GitHub and Meson's official wrapdb, which are plausible project-owned or trusted development hosts; all downloaded artifacts are checksummed and used to build the software locally, with no remote code execution or unverifiable binaries.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code from GitHub and Meson's official wrapdb, which are plausible project-owned or trusted development hosts; all downloaded artifacts are checksummed and used to build the software locally, with no remote code execution or unverifiable binaries.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 "imgui_1.92.5-1_patch.zip::https://wrapdb.mesonbuild.com/v2/imgui_1.92.5-1/get_patch"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: craftycorvid <me@ivanff.com>
    
      2#
    
      3# AUR VCS package: builds Choir from the latest commit on the public repo's main branch.
    
      4# (For the latest tagged release instead, see the choir-overlay package.)
    
      5pkgname=choir-overlay-git
    
      6pkgver=r89.gd80841f
    
      7pkgrel=1
    
      8pkgdesc="Discord voice overlay for Vulkan + OpenGL games (not affiliated with Discord Inc.)"
    
      9arch=('x86_64')
    
      10url="https://github.com/craftycorvid/choir-overlay"
    
      11license=('MIT')
    
      12depends=('qt6-base' 'qt6-svg' 'vulkan-icd-loader' 'libglvnd')
    
      13makedepends=('git' 'meson' 'vulkan-headers')
    
      14provides=('choir-overlay')
    
      15conflicts=('choir-overlay')
    
      16# Dear ImGui + nlohmann/json are pulled via meson wraps. Fetch those wrap downloads here
    
      17# (checksummed) and pre-seed meson's packagecache in prepare() so build() resolves them
    
      18# offline — no network needed during the build itself.
    
      19source=(
    
      20  "$pkgname::git+https://github.com/craftycorvid/choir-overlay.git"
    
      21  "imgui-1.92.5.tar.gz::https://github.com/ocornut/imgui/archive/refs/tags/v1.92.5.tar.gz"
    
      22  "imgui_1.92.5-1_patch.zip::https://wrapdb.mesonbuild.com/v2/imgui_1.92.5-1/get_patch"
    
      23  "nlohmann_json-3.12.0.zip::https://github.com/nlohmann/json/releases/download/v3.12.0/include.zip"
    
      24)
    
      25noextract=(
    
      26  'imgui-1.92.5.tar.gz'
    
      27  'imgui_1.92.5-1_patch.zip'
    
      28  'nlohmann_json-3.12.0.zip'
    
      29)
    
      30sha256sums=(
    
      31  'SKIP'
    
      32  '0eb50fe9aeba1a51f96b5843c7f630a32ed2e9362d693c61b87e4fa870cf826d'
    
      33  '636e9099a55869f25a95739b345e844c6b42166a0a0d22837ffbedd8e7af0bce'
    
      34  'b8cb0ef2dd7f57f18933997c9934bb1fa962594f701cd5a8d3c2c80541559372'
    
      35)
    
      36
    
      37pkgver() {
    
      38  cd "$srcdir/$pkgname"
    
      39  # No release tags yet: r<commit-count>.g<short-hash>.
    
      40  printf 'r%s.g%s' "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      41}
    
      42
    
      43prepare() {
    
      44  # meson looks here (by the wrap's source_filename/patch_filename) before downloading.
    
      45  mkdir -p "$srcdir/$pkgname/subprojects/packagecache"
    
      46  cp -t "$srcdir/$pkgname/subprojects/packagecache/" \
    
      47    "$srcdir/imgui-1.92.5.tar.gz" \
    
      48    "$srcdir/imgui_1.92.5-1_patch.zip" \
    
      49    "$srcdir/nlohmann_json-3.12.0.zip"
    
      50}
    
      51
    
      52build() {
    
      53  meson setup "$srcdir/build" "$srcdir/$pkgname" \
    
      54    --prefix=/usr --buildtype=release -Dbuild_tests=false
    
      55  meson compile -C "$srcdir/build"
    
      56}
    
      57
    
      58package() {
    
      59  DESTDIR="$pkgdir" meson install -C "$srcdir/build"
    
      60  # imgui is linked statically into libchoir_overlay.so; the wrap also installs its
    
      61  # build-time libimgui.a — drop it (useless at runtime, namcap flags stray static libs).
    
      62  rm -f "$pkgdir/usr/lib/libimgui.a"
    
      63}
    
      64

Changes since previous scan

--- PKGBUILD @ 2026-06-20 20:09
+++ PKGBUILD @ 2026-08-18 00:03
@@ -1,14 +1,15 @@
 # Maintainer: craftycorvid <me@ivanff.com>
 #
 # AUR VCS package: builds Choir from the latest commit on the public repo's main branch.
+# (For the latest tagged release instead, see the choir-overlay package.)
 pkgname=choir-overlay-git
-pkgver=r65.g25f404f
+pkgver=r89.gd80841f
 pkgrel=1
-pkgdesc="Wayland Discord voice overlay for Vulkan games (not affiliated with Discord Inc.)"
+pkgdesc="Discord voice overlay for Vulkan + OpenGL games (not affiliated with Discord Inc.)"
 arch=('x86_64')
 url="https://github.com/craftycorvid/choir-overlay"
 license=('MIT')
-depends=('qt6-base' 'vulkan-icd-loader')
+depends=('qt6-base' 'qt6-svg' 'vulkan-icd-loader' 'libglvnd')
 makedepends=('git' 'meson' 'vulkan-headers')
 provides=('choir-overlay')
 conflicts=('choir-overlay')

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 19:26:43	MEDIUM	1
2026-06-20 20:09:46	CLEAN	3
2026-06-20 20:08:07	LOW	3