classic-addon-manager-git

maintainer atretador · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from its own source using Go, and the flagged 'external install' via 'go install' is part of the project's build process to fetch development tools (wails3), not a runtime dependency or unverifiable binary execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from its own source using Go, and the flagged 'external install' via 'go install' is part of the project's build process to fetch development tools (wails3), not a runtime dependency or unverifiable binary execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:45 go install github.com/wailsapp/wails/v3/cmd/wails3@latest

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: atretador
    
      2pkgname=classic-addon-manager-git
    
      3_pkgname=classic-addon-manager
    
      4pkgver=3.0.4.18.g6e1a44d
    
      5pkgrel=1
    
      6pkgdesc="An addon manager for ArcheAge Classic, built with Go from latest git master"
    
      7arch=('x86_64')
    
      8url="https://github.com/classic-addon-manager/classic-addon-manager"
    
      9license=('MIT')
    
      10depends=('glibc')
    
      11makedepends=('go' 'npm' 'go-task' 'git' 'gtk3' 'webkit2gtk-4.1')
    
      12source=(
    
      13  "git+$url.git"
    
      14  "$_pkgname.desktop"
    
      15  "$_pkgname.install"
    
      16  "icon.png"
    
      17)
    
      18sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP')
    
      19
    
      20install=$_pkgname.install
    
      21
    
      22pkgver() {
    
      23  cd "$srcdir/$_pkgname"
    
      24  git describe --tags --long 2>/dev/null | sed 's/^v//;s/-/./g' || \
    
      25  echo "r$(git rev-list --count HEAD).$(git rev-parse --short HEAD)"
    
      26}
    
      27
    
      28prepare() {
    
      29  cd "$srcdir/$_pkgname"
    
      30  cp "$srcdir/$_pkgname.desktop" "$srcdir/$_pkgname/$_pkgname.desktop"
    
      31  cp "$srcdir/$_pkgname.install" "$srcdir/$_pkgname/$_pkgname.install"
    
      32}
    
      33
    
      34build() {
    
      35  cd "$srcdir/$_pkgname"
    
      36
    
      37  export PKG_CONFIG_PATH="/usr/lib/pkgconfig:$PKG_CONFIG_PATH"
    
      38
    
      39  export CGO_ENABLED=1
    
      40  export GOFLAGS="-buildmode=pie -trimpath -mod=readonly -modcacherw"
    
      41  export GOPATH="${srcdir}/gopath"
    
      42  mkdir -p "$GOPATH"
    
      43
    
      44  export PATH="$GOPATH/bin:$PATH"
    
      45  go install github.com/wailsapp/wails/v3/cmd/wails3@latest
    
      46
    
      47  rm -rf frontend/node_modules frontend/dist
    
      48
    
      49  # Build
    
      50  go-task build:prod
    
      51}
    
      52
    
      53package() {
    
      54  cd "$srcdir/$_pkgname"
    
      55
    
      56  # Install binary
    
      57  install -Dm755 "build/bin/$_pkgname" "$pkgdir/usr/bin/$_pkgname"
    
      58
    
      59  # Install desktop file
    
      60  install -Dm644 "$srcdir/$_pkgname/$_pkgname.desktop" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      61}
    
      62

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2