dn-git

LOW

maintainer premysl 0 votes scanned 2026-10-09 00:05:33.126700

View on AUR

Why flagged

The source is a git repository hosted on the maintainer's own domain, which is plausibly the project's official source; building from a non-whitelisted host is normal for AUR packages when it is the project's own forge.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git repository hosted on the maintainer's own domain, which is plausibly the project's official source; building from a non-whitelisted host is normal for AUR packages when it is the project's own forge.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:46 "git+https://git.janouch.name/p/$_pkgname.git"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Přemysl Eric Janouch <p@janouch.name>
    
      2pkgname=dn-git
    
      3_pkgname=dawn
    
      4pkgver=r61.219393c
    
      5pkgrel=6
    
      6pkgdesc="Colour-managed image browser"
    
      7url="https://git.janouch.name/p/dawn"
    
      8arch=('x86_64')
    
      9license=('MPL-2.0')
    
      10conflicts=('dn')
    
      11provides=('dn')
    
      12makedepends=(
    
      13  'cmake'
    
      14  'git'
    
      15  'glslang'
    
      16  'librsvg'
    
      17  'pkg-config'
    
      18  'vulkan-headers'
    
      19)
    
      20depends=(
    
      21  'libcolord'
    
      22  'libjpeg-turbo'
    
      23  'libwebp'
    
      24  'qt6-base'
    
      25  'resvg'
    
      26  'shared-mime-info'
    
      27  'vulkan-driver'
    
      28  'vulkan-icd-loader'
    
      29  'wayland-protocols'
    
      30)
    
      31optdepends=(
    
      32  'gdk-pixbuf2: GdkPixbuf module support'
    
      33  'glycin: Glycin module support'
    
      34  'jxrlib: JPEG XR'
    
      35  'libheif: HEIF images'
    
      36  'libjxl: JPEG XL'
    
      37  'libraw: raw photo images'
    
      38  'librsvg: SVG images'
    
      39  'libtiff: TIFF images'
    
      40  'libxcursor: X cursor images'
    
      41  'openjpeg2: JPEG2000'
    
      42  'perl-image-exiftool: file information'
    
      43)
    
      44install=dn.install
    
      45source=(
    
      46  "git+https://git.janouch.name/p/$_pkgname.git"
    
      47  update-dn-desktop-files.hook
    
      48)
    
      49sha256sums=(
    
      50  SKIP
    
      51  baa1bcd3bc55eacd28ad54e78b64d1f872d3e40100bb98a1af43d7ba0d4743bd
    
      52)
    
      53
    
      54pkgver() {
    
      55  cd "$srcdir/$_pkgname"
    
      56  ( set -o pipefail
    
      57    git describe --long --tags 2>/dev/null | sed 's/\([^-]*-g\)/r\1/;s/-/./g' ||
    
      58    printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      59  )
    
      60}
    
      61
    
      62prepare() {
    
      63  cd "$srcdir/$_pkgname"
    
      64  git submodule init
    
      65  git submodule update
    
      66}
    
      67
    
      68build() {
    
      69  rm -rf "$srcdir/$_pkgname-build"
    
      70  mkdir "$srcdir/$_pkgname-build"
    
      71  cd "$srcdir/$_pkgname-build"
    
      72  cmake "$srcdir/$_pkgname" -DCMAKE_BUILD_TYPE=None \
    
      73    -DCMAKE_INSTALL_PREFIX=/usr
    
      74  make
    
      75}
    
      76
    
      77package() {
    
      78  cd "$srcdir/$_pkgname-build"
    
      79  make install DESTDIR="$pkgdir"
    
      80  install -Dm644 "$srcdir/$_pkgname/LICENSE" \
    
      81    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      82  install -Dt "$pkgdir/usr/share/libalpm/hooks" -m644 \
    
      83	  "$srcdir/update-dn-desktop-files.hook"
    
      84}
    
      85

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 00:13:36	Low	2
2026-10-05 00:08:03	Low	2
2026-10-04 00:18:08	Low	2
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2
2026-09-27 00:07:07	Low	2
2026-09-26 00:12:15	Low	2
2026-09-25 00:03:36	Low	2
2026-09-24 00:24:14	Low	2
2026-09-23 00:28:13	Low	2
2026-09-22 00:15:14	Low	2
2026-09-21 00:26:32	Low	2
2026-09-20 00:25:31	Low	2