dumber-browser-git

MEDIUM

maintainer bnema 1 votes scanned 2026-10-22 09:34:24.719450

View on AUR

Why flagged

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:30 source=("git+https://git.bnema.dev/dumber.git")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: bnema <b at bnema dot dev>
    
      2pkgname=dumber-browser-git
    
      3pkgver=0.33.2.r1.g355c90ac
    
      4pkgrel=1
    
      5pkgdesc="A minimal keyboard-driven browser for tiling WMs (git version)"
    
      6arch=('x86_64')
    
      7url="https://git.bnema.dev/dumber"
    
      8license=('MIT')
    
      9makedepends=('go>=1.27' 'git' 'brotli')
    
      10depends=('gtk4' 'cef' 'webkitgtk-6.0')
    
      11optdepends=(
    
      12    'gst-plugins-base: Base media codecs'
    
      13    'gst-plugins-good: Additional media codecs'
    
      14    'gst-plugins-bad: Extended media codecs'
    
      15    'gst-plugins-ugly: Patented media codecs'
    
      16    'gst-libav: FFmpeg-based codecs'
    
      17    'gst-plugin-pipewire: PipeWire audio support'
    
      18    'gst-plugin-va: Hardware video decoding (VA-API stateless decoders)'
    
      19    'cef-vaapi-bin: Prebuilt CEF provider with VA-API hardware video decoding support'
    
      20    'cef-vaapi: Source-built CEF provider with VA-API hardware video decoding support'
    
      21    'pipewire: Audio/video routing'
    
      22    'pipewire-pulse: PulseAudio replacement'
    
      23    'mesa: VA-API driver for AMD GPUs'
    
      24    'libva-nvidia-driver: VA-API driver for NVIDIA GPUs'
    
      25    'libva-intel-driver: VA-API driver for older Intel GPUs'
    
      26    'intel-media-driver: VA-API driver for newer Intel GPUs (Broadwell+)'
    
      27)
    
      28provides=('dumber-browser' 'dumber')
    
      29conflicts=('dumber-browser' 'dumber-browser-bin')
    
      30source=("git+https://git.bnema.dev/dumber.git")
    
      31sha256sums=('SKIP')
    
      32
    
      33pkgver() {
    
      34    cd dumber
    
      35    git describe --long --tags 2>/dev/null | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g' || echo "0.0.0.r$(git rev-list --count HEAD).g$(git rev-parse --short HEAD)"
    
      36}
    
      37
    
      38build() {
    
      39    cd dumber
    
      40    export CGO_ENABLED=0
    
      41    # Keep global GOFLAGS wasm-safe; apply PIE only to native Go builds.
    
      42    export GOFLAGS="-trimpath -mod=readonly -modcacherw"
    
      43    export NATIVE_GOFLAGS="${GOFLAGS} -buildmode=pie"
    
      44    make build
    
      45}
    
      46
    
      47package() {
    
      48    cd dumber
    
      49    install -Dm755 dist/dumber "${pkgdir}/usr/bin/dumber"
    
      50    install -Dm644 flatpak/dev.bnema.Dumber.desktop "${pkgdir}/usr/share/applications/dev.bnema.Dumber.desktop"
    
      51    install -Dm644 assets/logo-512.png "${pkgdir}/usr/share/icons/hicolor/512x512/apps/dev.bnema.Dumber.png"
    
      52    install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      53}
    
      54

Changes since previous scan

--- PKGBUILD @ 2026-10-18 07:21
+++ PKGBUILD @ 2026-10-22 09:34
@@ -1,10 +1,10 @@
 # Maintainer: bnema <b at bnema dot dev>
 pkgname=dumber-browser-git
-pkgver=0.33.1.r2.gedd81385
+pkgver=0.33.2.r1.g355c90ac
 pkgrel=1
 pkgdesc="A minimal keyboard-driven browser for tiling WMs (git version)"
 arch=('x86_64')
-url="https://github.com/bnema/dumber"
+url="https://git.bnema.dev/dumber"
 license=('MIT')
 makedepends=('go>=1.27' 'git' 'brotli')
 depends=('gtk4' 'cef' 'webkitgtk-6.0')
@@ -27,7 +27,7 @@
 )
 provides=('dumber-browser' 'dumber')
 conflicts=('dumber-browser' 'dumber-browser-bin')
-source=("git+https://github.com/bnema/dumber.git")
+source=("git+https://git.bnema.dev/dumber.git")
 sha256sums=('SKIP')
 
 pkgver() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-22 09:34:24	Medium	1
2026-10-18 07:21:11	Clean	0
2026-10-18 05:21:06	Clean	0
2026-10-15 21:13:25	Clean	0
2026-10-14 17:20:19	Clean	0
2026-10-14 07:19:30	Clean	0
2026-10-14 05:19:21	Clean	0
2026-10-10 10:13:47	Clean	0
2026-10-10 02:12:41	Clean	0
2026-10-07 14:05:47	Clean	0
2026-10-05 23:40:58	Clean	0
2026-09-27 07:16:53	Clean	0
2026-09-24 05:42:19	Clean	0
2026-09-23 19:40:47	Clean	0
2026-09-23 07:39:45	Clean	0
2026-09-23 05:39:25	Clean	0
2026-09-22 07:37:25	Clean	0
2026-09-21 19:35:51	Clean	0
2026-09-20 17:33:19	Clean	0
2026-09-15 17:20:16	Clean	0