devinorium-git

LOW

maintainer HttpAnimations 0 votes scanned 2026-09-13 19:18:58.944598

View on AUR

Why flagged

The Flutter SDK is downloaded from the official Google storage.googleapis.com/flutter_infra_release CDN with a provided checksum; the project source is built from its own GitLab repo via cargo and flutter; the .desktop and .svg files are local bundled data with SKIP'd checksums but are non-executable; no obfuscated payloads, exfiltration, or untrusted prebuilt binaries are present — the SKIP'd checksums on data files and the git source are mildly sloppy but not dangerous.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The Flutter SDK is downloaded from the official Google storage.googleapis.com/flutter_infra_release CDN with a provided checksum; the project source is built from its own GitLab repo via cargo and flutter; the .desktop and .svg files are local bundled data with SKIP'd checksums but are non-executable; no obfuscated payloads, exfiltration, or untrusted prebuilt binaries are present — the SKIP'd checksums on data files and the git source are mildly sloppy but not dangerous.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 "flutter_linux_${_flutterver}-stable.tar.xz::https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${_flutterver}-stable.tar.xz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: HttpAnimations
    
      2pkgname=devinorium-git
    
      3_pkgname=devinorium
    
      4pkgver=0.73.1.r8.g8493297
    
      5pkgrel=1
    
      6pkgdesc="Self-hosted web UI for AI coding agents - desktop client (git build)"
    
      7arch=('x86_64')
    
      8url="https://gitlab.com/HttpAnimations/devinorium"
    
      9license=('AGPL-3.0-only')
    
      10options=('!lto')
    
      11depends=('gtk3' 'glibc' 'gcc-libs' 'git')
    
      12makedepends=('cargo' 'git' 'clang' 'cmake' 'ninja' 'pkgconf' 'unzip' 'zip' 'curl')
    
      13optdepends=('openssh: clone repositories over SSH'
    
      14            'xdg-utils: open URLs from the app'
    
      15            'zenity: native file dialogs')
    
      16provides=('devinorium')
    
      17conflicts=('devinorium')
    
      18_flutterver=3.44.9
    
      19source=("git+https://gitlab.com/HttpAnimations/devinorium.git"
    
      20        "flutter_linux_${_flutterver}-stable.tar.xz::https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${_flutterver}-stable.tar.xz"
    
      21        "devinorium.desktop"
    
      22        "devinorium.svg")
    
      23sha256sums=('SKIP'
    
      24            'a9120fa4a01048bdef438ddc3a2d4b7389662ea98a95db86eeaf10382bc4efcb'
    
      25            'SKIP'
    
      26            'SKIP')
    
      27
    
      28pkgver() {
    
      29  cd "$_pkgname"
    
      30  local ver
    
      31  ver=$(git describe --long --tags 2>/dev/null || true)
    
      32  if [ -n "$ver" ]; then
    
      33    printf '%s' "$ver" | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      34  else
    
      35    printf '0.0.0.r%s.g%s' "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      36  fi
    
      37}
    
      38
    
      39build() {
    
      40  export PATH="$srcdir/flutter/bin:$PATH"
    
      41  export PUB_CACHE="$srcdir/pub-cache"
    
      42  export CARGO_HOME="$srcdir/cargo-home"
    
      43  flutter config --no-analytics >/dev/null 2>&1 || true
    
      44  flutter precache --linux >/dev/null
    
      45
    
      46  # Server binary bundled into the desktop app. The app drives it over the API,
    
      47  # so the placeholder web frontend is enough here.
    
      48  cd "$_pkgname"
    
      49  cargo build --release --locked
    
      50
    
      51  cd flutter
    
      52  flutter pub get
    
      53  flutter build linux --release
    
      54  install -Dm755 ../target/release/devinorium build/linux/x64/release/bundle/server/devinorium
    
      55}
    
      56
    
      57package() {
    
      58  cd "$_pkgname"
    
      59  install -d "$pkgdir/opt/devinorium"
    
      60  cp -a flutter/build/linux/x64/release/bundle/. "$pkgdir/opt/devinorium/"
    
      61
    
      62  install -d "$pkgdir/usr/bin"
    
      63  ln -s /opt/devinorium/devinorium_frontend "$pkgdir/usr/bin/devinorium"
    
      64
    
      65  install -Dm644 "$srcdir/devinorium.desktop" "$pkgdir/usr/share/applications/devinorium.desktop"
    
      66  install -Dm644 "$srcdir/devinorium.svg" "$pkgdir/usr/share/icons/hicolor/scalable/apps/devinorium.svg"
    
      67  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      68}
    
      69

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-13 19:18:58	Low	3
2026-09-13 19:15:06	Medium	2