choir-overlay-git
LOW
maintainer CraftyCorvid
0 votes
scanned 2026-10-02 00:00:32.890515
Why flagged
The package downloads source code from GitHub and Meson's official wrapdb, which are plausible project-owned or trusted development hosts; all downloaded artifacts are checksummed and used to build the software locally, with no remote code execution or unverifiable binaries.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code from GitHub and Meson's official wrapdb, which are plausible project-owned or trusted development hosts; all downloaded artifacts are checksummed and used to build the software locally, with no remote code execution or unverifiable binaries.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:22
"imgui_1.92.5-1_patch.zip::https://wrapdb.mesonbuild.com/v2/imgui_1.92.5-1/get_patch"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: craftycorvid <me@ivanff.com>
2
#
3
# AUR VCS package: builds Choir from the latest commit on the public repo's main branch.
4
# (For the latest tagged release instead, see the choir-overlay package.)
5
pkgname=choir-overlay-git
6
pkgver=r89.gd80841f
7
pkgrel=1
8
pkgdesc="Discord voice overlay for Vulkan + OpenGL games (not affiliated with Discord Inc.)"
9
arch=('x86_64')
10
url="https://github.com/craftycorvid/choir-overlay"
11
license=('MIT')
12
depends=('qt6-base' 'qt6-svg' 'vulkan-icd-loader' 'libglvnd')
13
makedepends=('git' 'meson' 'vulkan-headers')
14
provides=('choir-overlay')
15
conflicts=('choir-overlay')
16
# Dear ImGui + nlohmann/json are pulled via meson wraps. Fetch those wrap downloads here
17
# (checksummed) and pre-seed meson's packagecache in prepare() so build() resolves them
18
# offline — no network needed during the build itself.
19
source=(
20
"$pkgname::git+https://github.com/craftycorvid/choir-overlay.git"
21
"imgui-1.92.5.tar.gz::https://github.com/ocornut/imgui/archive/refs/tags/v1.92.5.tar.gz"
22
"imgui_1.92.5-1_patch.zip::https://wrapdb.mesonbuild.com/v2/imgui_1.92.5-1/get_patch"
23
"nlohmann_json-3.12.0.zip::https://github.com/nlohmann/json/releases/download/v3.12.0/include.zip"
24
)
25
noextract=(
26
'imgui-1.92.5.tar.gz'
27
'imgui_1.92.5-1_patch.zip'
28
'nlohmann_json-3.12.0.zip'
29
)
30
sha256sums=(
31
'SKIP'
32
'0eb50fe9aeba1a51f96b5843c7f630a32ed2e9362d693c61b87e4fa870cf826d'
33
'636e9099a55869f25a95739b345e844c6b42166a0a0d22837ffbedd8e7af0bce'
34
'b8cb0ef2dd7f57f18933997c9934bb1fa962594f701cd5a8d3c2c80541559372'
35
)
36
37
pkgver() {
38
cd "$srcdir/$pkgname"
39
# No release tags yet: r<commit-count>.g<short-hash>.
40
printf 'r%s.g%s' "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
41
}
42
43
prepare() {
44
# meson looks here (by the wrap's source_filename/patch_filename) before downloading.
45
mkdir -p "$srcdir/$pkgname/subprojects/packagecache"
46
cp -t "$srcdir/$pkgname/subprojects/packagecache/" \
47
"$srcdir/imgui-1.92.5.tar.gz" \
48
"$srcdir/imgui_1.92.5-1_patch.zip" \
49
"$srcdir/nlohmann_json-3.12.0.zip"
50
}
51
52
build() {
53
meson setup "$srcdir/build" "$srcdir/$pkgname" \
54
--prefix=/usr --buildtype=release -Dbuild_tests=false
55
meson compile -C "$srcdir/build"
56
}
57
58
package() {
59
DESTDIR="$pkgdir" meson install -C "$srcdir/build"
60
# imgui is linked statically into libchoir_overlay.so; the wrap also installs its
61
# build-time libimgui.a — drop it (useless at runtime, namcap flags stray static libs).
62
rm -f "$pkgdir/usr/lib/libimgui.a"
63
}
64
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-02 00:00:32 | Low | 2 |
| 2026-10-01 00:02:06 | Low | 2 |
| 2026-09-30 00:20:07 | Low | 2 |
| 2026-09-29 00:07:46 | Low | 2 |
| 2026-09-28 00:28:32 | Low | 2 |
| 2026-09-27 00:07:07 | Low | 2 |
| 2026-09-26 00:12:15 | Low | 2 |
| 2026-09-25 00:03:36 | Low | 2 |
| 2026-09-24 00:24:14 | Low | 2 |
| 2026-09-23 00:28:13 | Low | 2 |
| 2026-09-22 00:15:14 | Low | 2 |
| 2026-09-21 00:26:32 | Low | 2 |
| 2026-09-20 00:25:31 | Low | 2 |
| 2026-09-19 00:25:36 | Low | 2 |
| 2026-09-18 00:17:11 | Low | 2 |
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |