fadein

LOW

maintainer notfire 2 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a source tarball from the official project domain for building, which is normal for AUR packages; the untrusted-host flag is a false positive as the host is the project's own.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from the official project domain for building, which is normal for AUR packages; the untrusted-host flag is a false positive as the host is the project's own.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:17 _current_version="$(curl -s 'https://www.fadeinpro.com/page.pl?content=version_notes' | sed -n 's/.*The current version is <b>$[0-9]*\.[0-9]*\.[0-9]*$<\/b>.*/\1/p')"

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("$pkgname-$pkgver.tar.gz::https://www.fadeinpro.com/download/demo/fadein-linux-x64-demo.tar.gz")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: notfire <luke@notfire.cc>
    
      2_maintainer_email="luke@notfire.cc"
    
      3pkgname=fadein
    
      4pkgver=5.0.15
    
      5pkgrel=1
    
      6pkgdesc="Professional screenwriting software (DEMO)"
    
      7arch=('x86_64')
    
      8url="http://www.fadeinpro.com/"
    
      9# No license file is provided.
    
      10license=('custom')
    
      11depends=('gtk3' 'webkit2gtk-4.1' 'libtiff5')
    
      12source=("$pkgname-$pkgver.tar.gz::https://www.fadeinpro.com/download/demo/fadein-linux-x64-demo.tar.gz")
    
      13sha512sums=('adb00e36683029abff2cfcdf9f3211fec278a4b07b246c6529dcf4a684e62ce4419479d37cacdcfda1c289d43c00bab660520fbfbc4d0bc98fd1ea5dcf8544f2')
    
      14
    
      15_vendor_name="fadein-linux-x86_64"
    
      16
    
      17_current_version="$(curl -s 'https://www.fadeinpro.com/page.pl?content=version_notes' | sed -n 's/.*The current version is <b>\([0-9]*\.[0-9]*\.[0-9]*\)<\/b>.*/\1/p')"
    
      18
    
      19if [[ "$_current_version" != "$pkgver" ]] then
    
      20    echo "ERROR: the fadein package is out of date and may not build properly.
    
      21The latest version is ${_current_version}.
    
      22Please flag the package as out of date at https://aur.archlinux.org/packages/$pkgname
    
      23or e-mail me at $_maintainer_email and I will fix this as soon as possible." 1>&2
    
      24fi
    
      25
    
      26package() {
    
      27    cd "$_vendor_name-$pkgver"
    
      28
    
      29    install -d ${pkgdir}/usr/share/
    
      30    cp -R usr/share/fadein ${pkgdir}/usr/share/
    
      31
    
      32    install -Dm644 usr/share/applications/fadein.desktop ${pkgdir}/usr/share/applications/fadein.desktop
    
      33
    
      34    install -d ${pkgdir}/usr/bin/
    
      35    ln -s /usr/share/fadein/fadein ${pkgdir}/usr/bin/fadein
    
      36}
    
      37# modeline:
    
      38# vim: ts=4 sts=4 sw=4 et
    
      39

Changes since previous scan

--- PKGBUILD @ 2026-10-18 00:06
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
 # Maintainer: notfire <luke@notfire.cc>
 _maintainer_email="luke@notfire.cc"
 pkgname=fadein
-pkgver=5.0.14
+pkgver=5.0.15
 pkgrel=1
 pkgdesc="Professional screenwriting software (DEMO)"
 arch=('x86_64')
@@ -10,7 +10,7 @@
 license=('custom')
 depends=('gtk3' 'webkit2gtk-4.1' 'libtiff5')
 source=("$pkgname-$pkgver.tar.gz::https://www.fadeinpro.com/download/demo/fadein-linux-x64-demo.tar.gz")
-sha512sums=('b25e2e47443dbb69e9d6ad5e870db59034a00963d38372bf92e1f68b8d9e4609baab9655f8d4ffc87a528b5d0bdb8abdce6508fe9a3b2dc5336702febbb0ca6b')
+sha512sums=('adb00e36683029abff2cfcdf9f3211fec278a4b07b246c6529dcf4a684e62ce4419479d37cacdcfda1c289d43c00bab660520fbfbc4d0bc98fd1ea5dcf8544f2')
 
 _vendor_name="fadein-linux-x86_64"
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	3
2026-10-31 00:07:41	Low	3
2026-10-30 00:29:30	Low	3
2026-10-29 00:13:55	Low	3
2026-10-28 00:06:54	Low	3
2026-10-27 00:23:28	Low	3
2026-10-26 00:12:40	Low	3
2026-10-25 00:20:48	Low	3
2026-10-24 00:14:55	Low	3
2026-10-23 00:02:19	Low	3
2026-10-22 00:13:10	Low	3
2026-10-21 00:12:50	Low	3
2026-10-20 00:10:31	Low	3
2026-10-19 00:03:55	Low	3
2026-10-18 01:20:44	Medium	2
2026-10-18 00:06:55	Low	3
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3
2026-10-15 00:28:05	Low	3
2026-10-14 00:06:47	Low	3