factor

LOW

maintainer megapoliss 33 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The source URL is from the project's official domain (factorcode.org), which is a standard and trusted host for this software, despite not being on the analyzer's whitelist; the package builds from official source code and poses no execution risk beyond normal build processes.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source URL is from the project's official domain (factorcode.org), which is a standard and trusted host for this software, despite not being on the analyzer's whitelist; the package builds from official source code and poses no execution risk beyond normal build processes.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source=(http://downloads.factorcode.org/releases/$pkgver/$pkgname-src-$pkgver.zip

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sergii Fesenko <sergii underscore f dot at outlook dot com>
    
      2# Contributor: Leonidas <marek@xivilization.net>
    
      3pkgname=factor
    
      4pkgver=0.102
    
      5pkgrel=1
    
      6pkgdesc="A general purpose, dynamically typed, stack-based programming language."
    
      7arch=(i686 x86_64)
    
      8url="https://factorcode.org"
    
      9license=(BSD)
    
      10provides=(factor)
    
      11conflicts=(factor-git)
    
      12
    
      13depends_i686=('gtk3' 'openssl')
    
      14makedepends_i686=('gtk3')
    
      15
    
      16depends=('gtk4' 'openssl')
    
      17makedepends=('gtk4')
    
      18optdepends=('udis86: enables "disassemble" (tools.disassembler)'
    
      19            'rlwrap: readline editing in the terminal listener (as recommended by build.sh deps-pacman)')
    
      20options=(!strip)
    
      21source=(http://downloads.factorcode.org/releases/$pkgver/$pkgname-src-$pkgver.zip
    
      22        factor-app-id.patch)
    
      23sha512sums=('413d355b481982bc5adad0ff1eaad5314ba0e4953599b481e7ccd4baf9a842c896a41e1fd085f19d25f0bc77e8be4cae3c789de9be16603d6fe70338c1e86cb0'
    
      24            '01685c39a623ad812f370c122be85d99c38ce7bd1eac9b51708e1cc7b4c62439b69d49d29b25cae6b341c6a0676dba53bf909bb290cb2740089f454efe0d0942')
    
      25
    
      26prepare() {
    
      27    cd $pkgname
    
      28    patch -Np1 -i "$srcdir/factor-app-id.patch"
    
      29}
    
      30
    
      31build() {
    
      32    cd $pkgname
    
      33
    
      34    # build the VM
    
      35    make
    
      36
    
      37    # thanks to qx from #concatenative for the proper SSE settings:
    
      38    # i686: no SSE, x87 floating point => -sse-version=0
    
      39    # x86_64: SSE2 => (autodetect) -sse-version=20
    
      40    if [ $CARCH = x86_64 ]; then
    
      41        ./factor -i="boot.unix-x86.64.image"
    
      42    else
    
      43        # bootstrap factor with the minimum supported SSE
    
      44        ./factor -i="boot.unix-x86.32.image" -sse-version=0
    
      45    fi
    
      46}
    
      47
    
      48package() {
    
      49    mkdir -p $pkgdir/usr/bin
    
      50    mkdir -p $pkgdir/usr/lib/factor
    
      51    mkdir -p $pkgdir/usr/share/licenses/$pkgname/
    
      52
    
      53    # copy over the stdlib
    
      54    cd $srcdir/$pkgname
    
      55    cp -a misc extra core basis factor.image $pkgdir/usr/lib/factor/
    
      56    # make folders r+x and files r
    
      57    chmod -R 0755 $pkgdir/usr/lib/factor
    
      58    find $pkgdir/usr/lib/factor -type f -exec chmod -x {} \;
    
      59
    
      60    # copy over the actual binary and create a symlink called factor-vm
    
      61    # (otherwise it conflicts with factor from the GNU coreutils)
    
      62    cp -a factor $pkgdir/usr/lib/factor/factor
    
      63    ln -s ../lib/factor/factor $pkgdir/usr/bin/factor-vm
    
      64
    
      65    # copy over the license (as defined in Arch Packaging Standards)
    
      66    chmod -x LICENSE.txt
    
      67    cp LICENSE.txt $pkgdir/usr/share/licenses/$pkgname/COPYING
    
      68
    
      69    # add the desktop entry from the distribution, adjusted to use factor-vm
    
      70    # (the upstream Exec=factor would conflict with GNU coreutils).
    
      71    # StartupWMClass only matters for X11/XWayland sessions and has to match
    
      72    # the WM_CLASS the backend advertises: the GTK4 backend derives both
    
      73    # components from the program name, while the GTK3 backend sets the class
    
      74    # to "Factor" explicitly.
    
      75    if [ "$CARCH" = x86_64 ]; then
    
      76        wmclass=factor
    
      77    else
    
      78        wmclass=Factor
    
      79    fi
    
      80    sed -e 's|^Exec=factor$|Exec=factor-vm|' \
    
      81        -e "s|^StartupWMClass=.*|StartupWMClass=$wmclass|" \
    
      82        "$srcdir/$pkgname/misc/factor.desktop" |
    
      83        install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/factor.desktop"
    
      84    install -Dm644 "$srcdir/$pkgname/misc/icons/icon.svg" \
    
      85        "$pkgdir/usr/share/pixmaps/factor.svg"
    
      86}
    
      87
    
      88

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-10-17 00:21
@@ -1,28 +1,31 @@
 # Maintainer: Sergii Fesenko <sergii underscore f dot at outlook dot com>
 # Contributor: Leonidas <marek@xivilization.net>
 pkgname=factor
-pkgver=0.100
+pkgver=0.102
 pkgrel=1
 pkgdesc="A general purpose, dynamically typed, stack-based programming language."
 arch=(i686 x86_64)
-url="http://factorcode.org"
+url="https://factorcode.org"
 license=(BSD)
 provides=(factor)
 conflicts=(factor-git)
-depends=(gtkglext)
+
+depends_i686=('gtk3' 'openssl')
+makedepends_i686=('gtk3')
+
+depends=('gtk4' 'openssl')
+makedepends=('gtk4')
+optdepends=('udis86: enables "disassemble" (tools.disassembler)'
+            'rlwrap: readline editing in the terminal listener (as recommended by build.sh deps-pacman)')
 options=(!strip)
 source=(http://downloads.factorcode.org/releases/$pkgver/$pkgname-src-$pkgver.zip
-        factor.desktop
-        factor.svg
-        fuel-factor-vm.patch)
-sha512sums=('7a653ca646f499944d91b5a584883da025dccde2e0a065d353a80c85cd2959f6c2380fed8b091431a4ec7aadbcbacd2b39206074ddb6f8570f48758f3ab35da7'
-            '19cf98d0fce2f1f65db4d3416c9577aa5e1f9c5829fab8f722756d37d4683caf3c740669ba895660a66177b6b38e3c7a30153ca70a515e91a455b83c4a55a026'
-            '4065a22cd10873f74024655aa71aafa2b96c0e391f61a5e71f5f4fac9b49955428528c2666da5e6e5058aa28347b0f9327575f2467baf9e3914739b8fa0b2c26'
-            '743b7d1332acc9863968686b2182bc9e9fa91822abd8c3b63a7933480b014dce15e86bb69201695186af26a6b267705e0618f131632249b2c3872d85a1973b07')
+        factor-app-id.patch)
+sha512sums=('413d355b481982bc5adad0ff1eaad5314ba0e4953599b481e7ccd4baf9a842c896a41e1fd085f19d25f0bc77e8be4cae3c789de9be16603d6fe70338c1e86cb0'
+            '01685c39a623ad812f370c122be85d99c38ce7bd1eac9b51708e1cc7b4c62439b69d49d29b25cae6b341c6a0676dba53bf909bb290cb2740089f454efe0d0942')
+
 prepare() {
     cd $pkgname
-    # apply patches
-    patch -p1 < $srcdir/fuel-factor-vm.patch
+    patch -Np1 -i "$srcdir/factor-app-id.patch"
 }
 
 build() {
@@ -57,17 +60,29 @@
     # copy over the actual binary and create a symlink called factor-vm
     # (otherwise it conflicts with factor from the GNU coreutils)
     cp -a factor $pkgdir/usr/lib/factor/factor
-    cd $pkgdir/usr/bin
-    ln -s ../lib/factor/factor factor-vm
-    cd -
+    ln -s ../lib/factor/factor $pkgdir/usr/bin/factor-vm
 
     # copy over the license (as defined in Arch Packaging Standards)
     chmod -x LICENSE.txt
     cp LICENSE.txt $pkgdir/usr/share/licenses/$pkgname/COPYING
 
-    # add the desktop entry
-    install -D "$srcdir/factor.desktop" "$pkgdir/usr/share/applications/factor.desktop"
-    install -D "$srcdir/factor.svg" "$pkgdir/usr/share/pixmaps/factor.svg"
+    # add the desktop entry from the distribution, adjusted to use factor-vm
+    # (the upstream Exec=factor would conflict with GNU coreutils).
+    # StartupWMClass only matters for X11/XWayland sessions and has to match
+    # the WM_CLASS the backend advertises: the GTK4 backend derives both
+    # components from the program name, while the GTK3 backend sets the class
+    # to "Factor" explicitly.
+    if [ "$CARCH" = x86_64 ]; then
+        wmclass=factor
+    else
+        wmclass=Factor
+    fi
+    sed -e 's|^Exec=factor$|Exec=factor-vm|' \
+        -e "s|^StartupWMClass=.*|StartupWMClass=$wmclass|" \
+        "$srcdir/$pkgname/misc/factor.desktop" |
+        install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/factor.desktop"
+    install -Dm644 "$srcdir/$pkgname/misc/icons/icon.svg" \
+        "$pkgdir/usr/share/pixmaps/factor.svg"
 }
 
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 11:11:38	Medium	1
2026-06-19 19:07:35	Clean	2
2026-06-18 16:11:54	Medium	1