di-tui

LOW

maintainer prurigro 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is a legitimate project tarball from the project maintainer's own domain, building from source is standard practice, and the host, while not standard, is plausibly official for the project.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a legitimate project tarball from the project maintainer's own domain, building from source is standard practice, and the host, while not standard, is plausibly official for the project.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://code.adriano.fyi/me/di-tui/archive/v${pkgver}.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kevin MacMartin <prurigro@gmail.com>
    
      2
    
      3pkgname=di-tui
    
      4pkgver=1.15.0
    
      5pkgrel=1
    
      6pkgdesc='A simple terminal UI player for di.fm Premium'
    
      7url='https://code.adriano.fyi/me/di-tui'
    
      8license=('BSD')
    
      9depends=('pulse-native-provider')
    
      10makedepends=('go')
    
      11arch=('i686' 'x86_64' 'arm' 'armv6h' 'armv7h' 'aarch64')
    
      12source=("https://code.adriano.fyi/me/di-tui/archive/v${pkgver}.tar.gz")
    
      13sha512sums=('51287d689c8c1a10251fbed2f3f9773e550f28c781d055fc5d8c6da337cdb915059cd7148579a97ba8bfd72c637fee37c35949d3aadb5cfb93d564ef513c07e4')
    
      14
    
      15build() {
    
      16  export GOPATH="$srcdir"
    
      17  cd $pkgname
    
      18
    
      19  go build \
    
      20    -trimpath \
    
      21    -buildmode=pie \
    
      22    -mod=readonly \
    
      23    -modcacherw \
    
      24    -ldflags "-linkmode external -extldflags \"${LDFLAGS}\"" \
    
      25    .
    
      26}
    
      27
    
      28package() {
    
      29  cd $pkgname
    
      30  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      31  install -Dm755 $pkgname "$pkgdir/usr/bin/$pkgname"
    
      32}
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2