devinorium-server-git

LOW

maintainer HttpAnimations 0 votes scanned 2026-09-13 19:18:58.944598

View on AUR

Why flagged

The Flutter SDK is downloaded from Google's official storage.googleapis.com infrastructure (the project's own distribution channel), the main source is the project's own GitLab repo built with Cargo, and the only concern is several SKIP'd checksums (including the Flutter tarball) which is sloppy but not malicious; no obfuscated payloads, no exfiltration, and no unrelated third-party binary hosting.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): The Flutter SDK is downloaded from Google's official storage.googleapis.com infrastructure (the project's own distribution channel), the main source is the project's own GitLab repo built with Cargo, and the only concern is several SKIP'd checksums (including the Flutter tarball) which is sloppy but not malicious; no obfuscated payloads, no exfiltration, and no unrelated third-party binary hosting.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 "flutter_linux_${_flutterver}-stable.tar.xz::https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${_flutterver}-stable.tar.xz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: HttpAnimations
    
      2pkgname=devinorium-server-git
    
      3_pkgname=devinorium
    
      4pkgver=0.73.1.r8.g8493297
    
      5pkgrel=1
    
      6pkgdesc="Self-hosted web UI for AI coding agents - server (git build)"
    
      7arch=('x86_64')
    
      8url="https://gitlab.com/HttpAnimations/devinorium"
    
      9license=('AGPL-3.0-only')
    
      10options=('!lto')
    
      11depends=('glibc' 'gcc-libs' 'git')
    
      12makedepends=('cargo' 'git' 'unzip' 'zip' 'curl')
    
      13optdepends=('openssh: clone repositories over SSH')
    
      14provides=('devinorium-server')
    
      15conflicts=('devinorium-server')
    
      16backup=('etc/devinorium/devinorium.env')
    
      17_flutterver=3.44.9
    
      18source=("git+https://gitlab.com/HttpAnimations/devinorium.git"
    
      19        "flutter_linux_${_flutterver}-stable.tar.xz::https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${_flutterver}-stable.tar.xz"
    
      20        "devinorium.service"
    
      21        "devinorium.sysusers"
    
      22        "devinorium.env")
    
      23sha256sums=('SKIP'
    
      24            'a9120fa4a01048bdef438ddc3a2d4b7389662ea98a95db86eeaf10382bc4efcb'
    
      25            'SKIP'
    
      26            'SKIP'
    
      27            'SKIP')
    
      28
    
      29pkgver() {
    
      30  cd "$_pkgname"
    
      31  local ver
    
      32  ver=$(git describe --long --tags 2>/dev/null || true)
    
      33  if [ -n "$ver" ]; then
    
      34    printf '%s' "$ver" | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      35  else
    
      36    printf '0.0.0.r%s.g%s' "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      37  fi
    
      38}
    
      39
    
      40build() {
    
      41  export PATH="$srcdir/flutter/bin:$PATH"
    
      42  export PUB_CACHE="$srcdir/pub-cache"
    
      43  export CARGO_HOME="$srcdir/cargo-home"
    
      44  flutter config --no-analytics >/dev/null 2>&1 || true
    
      45  flutter precache --web >/dev/null
    
      46
    
      47  cd "$_pkgname/flutter"
    
      48  flutter pub get
    
      49  flutter build web --release --wasm
    
      50  rm -rf build/web/canvaskit
    
      51
    
      52  rm -rf ../frontend/dist
    
      53  mkdir -p ../frontend/dist
    
      54  cp -r build/web/. ../frontend/dist/
    
      55
    
      56  cd ..
    
      57  cargo build --release --locked
    
      58}
    
      59
    
      60package() {
    
      61  cd "$_pkgname"
    
      62  install -Dm755 target/release/devinorium "$pkgdir/usr/bin/devinorium-server"
    
      63  install -Dm644 "$srcdir/devinorium.service" "$pkgdir/usr/lib/systemd/system/devinorium.service"
    
      64  install -Dm644 "$srcdir/devinorium.sysusers" "$pkgdir/usr/lib/sysusers.d/devinorium.conf"
    
      65  install -Dm600 "$srcdir/devinorium.env" "$pkgdir/etc/devinorium/devinorium.env"
    
      66  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      67}
    
      68

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-13 19:18:58	Low	3
2026-09-13 19:15:06	Medium	2