deshader-git

maintainer OSDVF · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The external download of bun and vcpkg occurs during prepare() but both are build tools used to compile the project's own source; the final binaries are built from the git source and the downloads are from official, well-known domains (bun.sh, github.com/microsoft/vcpkg), posing minimal supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The external download of bun and vcpkg occurs during prepare() but both are build tools used to compile the project's own source; the final binaries are built from the git source and the downloads are from official, well-known domains (bun.sh, github.com/microsoft/vcpkg), posing minimal supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:126 curl -fsSL https://bun.sh/install | BUN_INSTALL="$srcdir/dep" bash

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: o.s.dv.f@seznam.cz
    
      2pkgname=deshader-git
    
      3pkgver=rb5aee41
    
      4pkgrel=1
    
      5pkgdesc="Shader debugging via GLSL code instrumentation. This is preliminary package, does not coply with all package guidelines."
    
      6arch=(armv7h
    
    aarch64
    
    x86_64
    
    i686)
    
      10url="https://github.com/OSDVF/deshader"
    
      11depends=('gtk3'
    
       'webkit2gtk')
    
      13makedepends=('git'
    
           'zig=0.14.0'
    
           'binutils'
    
           'unzip'
    
           'curl'
    
           'zip'
    
           'tar'
    
           'pkgconf'
    
           )
    
      22optdepends=()
    
      23options=(!lto !strip)
    
      24provides=("deshader=$pkgver"
    
        "deshader-run=$pkgver"
    
        "libdeshader.so")
    
      27conflicts=('deshader'
    
        'deshader-run')
    
      29source=('deshader.desktop'
    
      '48.png'
    
      '256.png'
    
      'scalable.svg'
    
      'git+https://github.com/OSDVF/deshader.git')
    
      34sha256sums=('fba58063082fef9ea30cb88a73ac1877360abcca0cef36859a3ee096528fcd12'
    
          '00bcebeeb6423504e5b877c398751bfa15df23266131ffe1fb3058e2f1511de4'
    
          'dd20694f4cc973e44ce5df87a7da166515aa9df6a8045fa13df726980308aa92'
    
          '067392a62f68bf6354c9fefc34788b9a350f56e19ac899248da1142df7541e4b'
    
          'SKIP')
    
      39license=('GPL-3.0-or-later')
    
      40
    
      41pkgver() {
    
  cd "$srcdir/${pkgname%-git}" || exit 1
    
  MAYBE_TAG=$(git describe --tags --abbrev=0 --exact-match 2>/dev/null || echo "")
    
  if [[ "$MAYBE_TAG" != "" ]] && [[ $MAYBE_TAG =~ ^[[:digit:]] ]]; then 
    
      echo $MAYBE_TAG # tag that begins with a digit => release version, use tag name
    
  else 
    
      printf "r%s" "$(git rev-parse --short HEAD)" # no tag or dev tag => development version, use commit hash
    
  fi
    
      49}
    
      50
    
      51build_deshader() {
    
  zig build deshader --release=safe # do not override build flags by makepkg
    
      53}
    
      54
    
      55build_launcher() {
    
  zig build launcher --release=safe # do not override build flags by makepkg
    
      57}
    
      58
    
      59build() {
    
  # do not override build flags by makepkg -- will corrupt the build for use with Zig
    
  export CFLAGS=""
    
  export CXXFLAGS=""
    
  export CPPFLAGS=""
    
  if [[ "$OSTYPE" == "linux*" ]]; then
    
      export LDFLAGS="-z,itb,-z,shstk"
    
  fi
    
      67
    
  cd "$srcdir/${pkgname%-git}" || exit 1
    
  if ! build_deshader; then # must be ran twice to fix the C import
    
      sh fix_c_import.sh
    
      echo "Retrying build"
    
      if ! build_deshader; then # maybe three times
    
          sh fix_c_import.sh
    
          echo "Retrying build third time"
    
          build_deshader
    
      fi
    
  fi
    
  if ! build_launcher; then # must be ran twice to fix the C import
    
      sh fix_c_import.sh
    
      echo "Retrying launcher build"
    
      if ! build_launcher; then # maybe three times
    
          sh fix_c_import.sh
    
          echo "Retrying launcher build third time"
    
          build_launcher
    
      fi
    
  fi
    
      87}
    
      88
    
      89check() {
    
  pass=false
    
  if [[ "$OSTYPE" == darwin* ]]; then
    
      LIBEXT=dylib
    
  else
    
      LIBEXT=so
    
  fi
    
  output=`DESHADER_LIB="$srcdir/${pkgname%-git}/zig-out/lib/libdeshader.$LIBEXT" "$srcdir/${pkgname%-git}/zig-out/bin/deshader-run" --version`
    
  for line in $output
    
  do
    
      if [ "$pkgver" == "$line" ] || [ $pkgver == "r$line" ]; then
    
          pass=true
    
          echo "Built $pkgver matches"
    
          break
    
      fi
    
  done
    
  if ! $pass; then
    
      echo "Version $pkgver does not match $output"
    
      exit 1
    
  fi
    
      109}
    
      110
    
      111prepare() {
    
  export PATH="$srcdir/dep/bin:$srcdir/vcpkg:$PATH"
    
  export ZIG_GLOBAL_CACHE_DIR="$srcdir/dep/.zig-cache"
    
  export VCPKG_DEFAULT_BINARY_CACHE_DIR="$srcdir/dep/.vcpkg-cache"
    
  export VCPKG_DISABLE_METRICS=1
    
      116
    
  # get the submodules
    
  cd "$srcdir/${pkgname%-git}" || exit 1
    
      119
    
  git submodule update --init --recursive
    
      121
    
  cd "$srcdir" || exit 1
    
  # check for bun in the path
    
  if ! command -v bun; then
    
      # download bun
    
      curl -fsSL https://bun.sh/install | BUN_INSTALL="$srcdir/dep" bash
    
  fi
    
      128
    
  # check for VCPKG
    
  if ! command -v vcpkg; then
    
      # check for downloaded VCPKG repository
    
      if [ -d "$srcdir/vcpkg" ]; then
    
          # check if it is a git repository
    
          if [ -d "$srcdir/vcpkg/.git" ]; then
    
              # update VCPKG
    
              cd "$srcdir/vcpkg" || exit 1
    
              git pull
    
          else
    
              # remove the directory
    
              rm -rf "$srcdir/vcpkg"
    
          fi
    
      
    
      else
    
          # download VCPKG
    
          git clone https://github.com/microsoft/vcpkg.git
    
      fi
    
      cd "$srcdir/vcpkg" || exit 1
    
      chmod +x ./bootstrap-vcpkg.sh
    
      ./bootstrap-vcpkg.sh
    
  fi
    
      151}
    
      152
    
      153package() {
    
  install -d "${pkgdir}/usr/bin"
    
  install -d "${pkgdir}/usr/lib"
    
  install -d "${pkgdir}/usr/share/applications"
    
  install -d "${pkgdir}/usr/share/icons/hicolor/48x48/apps"
    
  install -d "${pkgdir}/usr/share/icons/hicolor/256x256/apps"
    
  install -d "${pkgdir}/usr/share/icons/hicolor/scalable/apps"
    
      160
    
  install -m755 "$srcdir/${pkgname%-git}/zig-out/bin/deshader-run" "$pkgdir/usr/bin/deshader-run"
    
  install -m755 "$srcdir/${pkgname%-git}/zig-out/lib/libdeshader.so" "$pkgdir/usr/lib/libdeshader.so"
    
      163
    
  #install headers
    
  install -d "${pkgdir}/usr/include/deshader"
    
  for h in "$srcdir/${pkgname%-git}/zig-out/include/deshader/"*; do
    
      install -m644 "$h" "$pkgdir/usr/include/deshader/"
    
  done
    
      169
    
  #install desktop file and icons
    
  install -m644 "$srcdir/deshader.desktop" "$pkgdir/usr/share/applications/deshader.desktop"
    
  install -m644 "$srcdir/48.png" "$pkgdir/usr/share/icons/hicolor/48x48/apps/deshader.png"
    
  install -m644 "$srcdir/256.png" "$pkgdir/usr/share/icons/hicolor/256x256/apps/deshader.png"
    
  install -m644 "$srcdir/scalable.svg" "$pkgdir/usr/share/icons/hicolor/scalable/apps/deshader.svg"
    
      175}
    
      176

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2