dart-sdk-dev
LOW
maintainer KlarkKable
11 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The source is a prebuilt Dart SDK from Google's official dart-archive storage bucket, which is the project's legitimate release infrastructure;虽非标准域名但属项目官方资源，且安装的是公开的开发版SDK，无执行远程代码或恶意行为迹象.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a prebuilt Dart SDK from Google's official dart-archive storage bucket, which is the project's legitimate release infrastructure;虽非标准域名但属项目官方资源，且安装的是公开的开发版SDK，无执行远程代码或恶意行为迹象.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:12
source=(dartsdk-linux-x64-release-${pkgver}.zip::"https://storage.googleapis.com/dart-archive/channels/dev/release/${pkgver//_/-}/sdk/dartsdk-linux-x64-release.zip")
PKGBUILD
1 offending line(s) highlighted
1
#Maintainer: KlarkKable <KlarkKable at protonmail dot com>
2
pkgname=dart-sdk-dev
3
pkgver=3.14.0_219.0.dev
4
pkgrel=1
5
pkgdesc="The official Dart sdk from dart-lang project (Development branch)"
6
arch=('x86_64')
7
url="https://www.dartlang.org/tools/sdk/archive"
8
license=('custom')
9
depends=('unzip')
10
conflicts=('dart')
11
provides=('dart=$pkgver')
12
source=(dartsdk-linux-x64-release-${pkgver}.zip::"https://storage.googleapis.com/dart-archive/channels/dev/release/${pkgver//_/-}/sdk/dartsdk-linux-x64-release.zip")
13
sha256sums=('7b3ed5f4dede580e7bf85cce114e7fadea9cb8264f3fd0008b473b2b279ba102')
14
15
package() {
16
# Uncompressed name is "dart-sdk" not "dart-sdk-dev"
17
cd $srcdir/dart-sdk
18
19
# Install Application
20
install -d $pkgdir/{opt/$pkgname,usr/bin}
21
cp -a . $pkgdir/opt/$pkgname
22
for f in "$pkgdir"/opt/$pkgname/bin/*; do
23
ln -s /opt/$pkgname/bin/${f##*/} "$pkgdir"/usr/bin/
24
done
25
26
chmod -R ugo+rX $pkgdir/opt
27
}
28
Changes since previous scan
--- PKGBUILD @ 2026-09-16 00:03+++ PKGBUILD @ 2026-09-17 00:27@@ -1,6 +1,6 @@ #Maintainer: KlarkKable <KlarkKable at protonmail dot com> pkgname=dart-sdk-dev-pkgver=3.14.0_202.0.dev+pkgver=3.14.0_219.0.dev pkgrel=1 pkgdesc="The official Dart sdk from dart-lang project (Development branch)" arch=('x86_64')@@ -10,7 +10,7 @@ conflicts=('dart') provides=('dart=$pkgver') source=(dartsdk-linux-x64-release-${pkgver}.zip::"https://storage.googleapis.com/dart-archive/channels/dev/release/${pkgver//_/-}/sdk/dartsdk-linux-x64-release.zip")-sha256sums=('dd2cf0bd4454ff8301811416d02f8278cc49e1ba0cafb38c1ad786c36a6aa3c3')+sha256sums=('7b3ed5f4dede580e7bf85cce114e7fadea9cb8264f3fd0008b473b2b279ba102') package() { # Uncompressed name is "dart-sdk" not "dart-sdk-dev"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 01:20:46 | Medium | 1 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 01:18:32 | Medium | 1 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 01:49:31 | Medium | 1 |
| 2026-08-29 00:29:17 | Clean | 2 |
| 2026-08-28 01:33:41 | Medium | 1 |