dn-git

LOW

maintainer premysl 0 votes scanned 2026-08-25 03:27:27.700552

View on AUR

Why flagged

Builds from the maintainer's own git forge (git.janouch.name), which is plausibly the project's official host matching the declared url=; the bundled hook file has a verified checksum; the only real concern is the non-whitelisted personal git host and few votes, but there is no obfuscation, no remote code execution, and no unverifiable prebuilt binary.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Builds from the maintainer's own git forge (git.janouch.name), which is plausibly the project's official host matching the declared url=; the bundled hook file has a verified checksum; the only real concern is the non-whitelisted personal git host and few votes, but there is no obfuscation, no remote code execution, and no unverifiable prebuilt binary.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:41 "git+https://git.janouch.name/p/$_pkgname.git"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Přemysl Eric Janouch <p@janouch.name>
    
      2pkgname=dn-git
    
      3_pkgname=dawn
    
      4pkgver=r61.219393c
    
      5pkgrel=4
    
      6pkgdesc="Colour-managed image browser"
    
      7url="https://git.janouch.name/p/dawn"
    
      8arch=('x86_64')
    
      9license=('0BSD')
    
      10conflicts=('dn')
    
      11provides=('dn')
    
      12makedepends=(
    
      13  'cmake'
    
      14  'git'
    
      15  'glslang'
    
      16  'librsvg'
    
      17  'pkg-config'
    
      18  'vulkan-headers'
    
      19)
    
      20depends=(
    
      21  'libcolord'
    
      22  'libjpeg-turbo'
    
      23  'libwebp'
    
      24  'qt6-base'
    
      25  'resvg'
    
      26  'shared-mime-info'
    
      27  'vulkan-icd-loader'
    
      28  'wayland-protocols'
    
      29)
    
      30optdepends=(
    
      31  'gdk-pixbuf2: GdkPixbuf module support'
    
      32  'libheif: HEIF images'
    
      33  'libraw: raw photo images'
    
      34  'librsvg: SVG images'
    
      35  'libtiff: TIFF images'
    
      36  'libxcursor: X cursor images'
    
      37  'perl-image-exiftool: file information'
    
      38)
    
      39install=dn.install
    
      40source=(
    
      41  "git+https://git.janouch.name/p/$_pkgname.git"
    
      42  update-dn-desktop-files.hook
    
      43)
    
      44sha256sums=(
    
      45  SKIP
    
      46  baa1bcd3bc55eacd28ad54e78b64d1f872d3e40100bb98a1af43d7ba0d4743bd
    
      47)
    
      48
    
      49pkgver() {
    
      50  cd "$srcdir/$_pkgname"
    
      51  ( set -o pipefail
    
      52    git describe --long --tags 2>/dev/null | sed 's/\([^-]*-g\)/r\1/;s/-/./g' ||
    
      53    printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      54  )
    
      55}
    
      56
    
      57prepare() {
    
      58  cd "$srcdir/$_pkgname"
    
      59  git submodule init
    
      60  git submodule update
    
      61}
    
      62
    
      63build() {
    
      64  rm -rf "$srcdir/$_pkgname-build"
    
      65  mkdir "$srcdir/$_pkgname-build"
    
      66  cd "$srcdir/$_pkgname-build"
    
      67  cmake "$srcdir/$_pkgname" -DCMAKE_BUILD_TYPE=None \
    
      68    -DCMAKE_INSTALL_PREFIX=/usr
    
      69  make
    
      70}
    
      71
    
      72package() {
    
      73  cd "$srcdir/$_pkgname-build"
    
      74  make install DESTDIR="$pkgdir"
    
      75  install -Dm644 "$srcdir/$_pkgname/LICENSE" \
    
      76    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      77  install -Dt "$pkgdir/usr/share/libalpm/hooks" -m644 \
    
      78	  "$srcdir/update-dn-desktop-files.hook"
    
      79}
    
      80

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-25 03:27:27	Low	3
2026-08-25 03:25:42	Medium	2