devinorium-git

MEDIUM
maintainer HttpAnimations 0 votes scanned 2026-10-28 21:50:44.871523
View on AUR
Why flagged

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:20 "flutter_linux_${_flutterver}-stable.tar.xz::https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${_flutterver}-stable.tar.xz"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: HttpAnimations
2pkgname=devinorium-git
3_pkgname=devinorium
4pkgver=0.109.0.r4.gd480576
5pkgrel=1
6pkgdesc="Self-hosted web UI for AI coding agents - desktop client (git build)"
7arch=('x86_64')
8url="https://gitlab.com/HttpAnimations/devinorium"
9license=('AGPL-3.0-only')
10options=('!lto')
11depends=('gtk3' 'glibc' 'gcc-libs' 'git')
12makedepends=('cargo' 'git' 'clang' 'cmake' 'ninja' 'pkgconf' 'unzip' 'zip' 'curl')
13optdepends=('openssh: clone repositories over SSH'
14 'xdg-utils: open URLs from the app'
15 'zenity: native file dialogs')
16provides=('devinorium')
17conflicts=('devinorium')
18_flutterver=3.44.9
19source=("git+https://gitlab.com/HttpAnimations/devinorium.git"
20 "flutter_linux_${_flutterver}-stable.tar.xz::https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${_flutterver}-stable.tar.xz"
21 "devinorium.desktop"
22 "devinorium.svg")
23sha256sums=('SKIP'
24 'a9120fa4a01048bdef438ddc3a2d4b7389662ea98a95db86eeaf10382bc4efcb'
25 'SKIP'
26 'SKIP')
27
28pkgver() {
29 cd "$_pkgname"
30 local ver
31 ver=$(git describe --long --tags 2>/dev/null || true)
32 if [ -n "$ver" ]; then
33 printf '%s' "$ver" | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
34 else
35 printf '0.0.0.r%s.g%s' "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
36 fi
37}
38
39build() {
40 export PATH="$srcdir/flutter/bin:$PATH"
41 export PUB_CACHE="$srcdir/pub-cache"
42 export CARGO_HOME="$srcdir/cargo-home"
43 flutter config --no-analytics >/dev/null 2>&1 || true
44 flutter precache --linux >/dev/null
45
46 # Server binary bundled into the desktop app. The app drives it over the API,
47 # so the placeholder web frontend is enough here.
48 cd "$_pkgname"
49 cargo build --release --locked
50
51 cd flutter
52 flutter pub get
53 flutter build linux --release
54 install -Dm755 ../target/release/devinorium build/linux/x64/release/bundle/server/devinorium
55}
56
57package() {
58 cd "$_pkgname"
59 install -d "$pkgdir/opt/devinorium"
60 cp -a flutter/build/linux/x64/release/bundle/. "$pkgdir/opt/devinorium/"
61
62 install -d "$pkgdir/usr/bin"
63 ln -s /opt/devinorium/devinorium_frontend "$pkgdir/usr/bin/devinorium"
64
65 install -Dm644 "$srcdir/devinorium.desktop" "$pkgdir/usr/share/applications/gitlab.openlyst.devinorium.desktop"
66 install -Dm644 "$srcdir/devinorium.svg" "$pkgdir/usr/share/icons/hicolor/scalable/apps/devinorium.svg"
67 install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
68}
69

Changes since previous scan

--- PKGBUILD @ 2026-10-28 00:06
+++ PKGBUILD @ 2026-10-28 21:50
@@ -1,7 +1,7 @@
# Maintainer: HttpAnimations
pkgname=devinorium-git
_pkgname=devinorium
-pkgver=0.108.2.r3.gd035eb8
+pkgver=0.109.0.r4.gd480576
pkgrel=1
pkgdesc="Self-hosted web UI for AI coding agents - desktop client (git build)"
arch=('x86_64')

Scan history

Scanned at (UTC)SeverityRules
2026-10-28 21:50:44 Medium 1
2026-10-28 00:06:54 Low 2
2026-10-27 00:23:28 Low 2
2026-10-26 00:12:40 Low 2
2026-10-25 07:42:02 Medium 1
2026-10-25 00:20:48 Low 2
2026-10-24 21:41:28 Medium 1
2026-10-24 00:14:55 Low 2
2026-10-23 00:02:19 Low 2
2026-10-22 00:13:10 Low 2
2026-10-21 00:12:50 Low 2
2026-10-20 00:10:31 Low 2
2026-10-19 07:24:05 Medium 1
2026-10-19 05:23:55 Medium 1
2026-10-19 03:23:49 Medium 1
2026-10-19 01:23:43 Medium 1
2026-10-19 00:03:55 Low 2
2026-10-18 07:21:11 Medium 1
2026-10-18 00:06:55 Low 2
2026-10-17 21:19:24 Medium 1

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion