fcitx5-misstype-git
LOW
maintainer pastleo
0 votes
scanned 2026-10-17 00:21:55.226236
Why flagged
The package downloads source code and data files from trusted project repositories (GitHub) and verifies them with checksums; the only non-whitelisted host is raw.githubusercontent.com, which hosts publicly accessible data files, not executables, and the zig binary is downloaded with a fixed checksum, making the risk low.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code and data files from trusted project repositories (GitHub) and verifies them with checksums; the only non-whitelisted host is raw.githubusercontent.com, which hosts publicly accessible data files, not executables, and the zig binary is downloaded with a fixed checksum, making the risk low.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:49
source_x86_64=("https://ziglang.org/download/$_zig_version/zig-x86_64-linux-$_zig_version.tar.xz")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: PastLeo <chgu82837@gmail.com>
2
# AUR packaging recipe; see docs/arch-linux.md.
3
pkgname=fcitx5-misstype-git
4
pkgver=0.1.r212.g5135a1f
5
pkgrel=1
6
pkgdesc='Offline, fuzzy Zhuyin input method for fcitx5'
7
arch=('x86_64' 'aarch64')
8
url='https://github.com/Yukaii/misstype'
9
license=('MIT' 'BSD-3-Clause' 'CC-BY-4.0' 'CC-BY-SA-4.0' 'Unicode-3.0')
10
depends=('fcitx5' 'gcc-libs' 'glibc')
11
makedepends=('git' 'cmake' 'ninja' 'python' 'gtk4')
12
optdepends=('fcitx5-configtool: add Misstype to your input methods'
13
'gtk4: misstype-dictionary-editor'
14
'fcitx5-gtk: GTK application integration'
15
'fcitx5-qt: Qt application integration')
16
provides=('fcitx5-misstype')
17
conflicts=('fcitx5-misstype' 'fcitx5-mistype-git')
18
# Zig manages its own optimization and debug information.
19
options=('!lto' '!debug')
20
_mcbopomofo=f5ba010ce8795d283ee336ca7d16380f200bd2ec
21
_naer=889efe0da5e10f5eea5920027748e9dd1f58169a
22
_english=525f9b560de45753a5ea01069454e72e9aa541c6
23
source=("misstype::git+${MISSTYPE_SOURCE_URL:-$url.git}"
24
"BPMFBase.txt::https://raw.githubusercontent.com/openvanilla/McBopomofo/$_mcbopomofo/Source/Data/BPMFBase.txt"
25
"BPMFMappings.txt::https://raw.githubusercontent.com/openvanilla/McBopomofo/$_mcbopomofo/Source/Data/BPMFMappings.txt"
26
"phrase.occ::https://raw.githubusercontent.com/openvanilla/McBopomofo/$_mcbopomofo/Source/Data/phrase.occ"
27
"mcbopomofo-LICENSE.txt::https://raw.githubusercontent.com/openvanilla/McBopomofo/$_mcbopomofo/LICENSE.txt"
28
"mcbopomofo-README.md::https://raw.githubusercontent.com/openvanilla/McBopomofo/$_mcbopomofo/Source/Data/README.md"
29
"heterophony1.list::https://raw.githubusercontent.com/openvanilla/McBopomofo/$_mcbopomofo/Source/Data/heterophony1.list"
30
"heterophony2.list::https://raw.githubusercontent.com/openvanilla/McBopomofo/$_mcbopomofo/Source/Data/heterophony2.list"
31
"heterophony3.list::https://raw.githubusercontent.com/openvanilla/McBopomofo/$_mcbopomofo/Source/Data/heterophony3.list"
32
"frequency.tsv::https://raw.githubusercontent.com/chiakich/ChiaKey-Lexicon/$_naer/sources/naer-word-frequency/frequency.tsv"
33
"en_50k.txt::https://raw.githubusercontent.com/hermitdave/FrequencyWords/$_english/content/2018/en/en_50k.txt"
34
'cxx20.patch')
35
sha256sums=('SKIP'
36
'46e64a53dc9c6baa2cbe6e0b1af572f8ef6aafb50597178b5fd53df804316ce7'
37
'baa9452ef927b3268f600ca69fe27eb0838b8be31c8ae0dd8540561db68c7ffd'
38
'2dbe37c1c61266f65d158a3e0020a0c1f2a75039ebd7f1580ef8e537a7bc8779'
39
'72ed32193b0c629def66df63791b2fb125946b593a3251380e6b949488f47b72'
40
'4b2eea7122a2a4d8bea7f23f611c6817d681a55d397b1ba3f8100acbfeb9f82e'
41
'7fddbb6a66022b1809181484c7627d79dee4231849cb2d3c8c8cd4578b3d22cb'
42
'4afd69a2702ae3af533cd01b755f81d77a430ace91311a8229319334aec24e37'
43
'8be3f37fe419744c3792df1bdfc67a0abdb215dbbb759c92204d4f8d68a32cd9'
44
'd8bf3ebec541c3dde967d536e05a33a2b8d5e4c4aeea1205feb4f0867220169a'
45
'5351ff405b1126ef555791dd4d9798a48e3e9a501a9fc481a9da957752cfb458'
46
'6dac94bbaab952f27dec7b79c9dff062f6f31ab4d471770e13a132516aed8e6a')
47
48
_zig_version=0.17.0
49
source_x86_64=("https://ziglang.org/download/$_zig_version/zig-x86_64-linux-$_zig_version.tar.xz")
50
sha256sums_x86_64=('1cbe9df9f27e6b78d14ccbca43b6703a404ef79ef1c463de901d7f088d4e2026')
51
source_aarch64=("https://ziglang.org/download/$_zig_version/zig-aarch64-linux-$_zig_version.tar.xz")
52
sha256sums_aarch64=('9e8d11661d4ae3bd57702a3832781e23ad151dde5798e16a5ccd503f65234ff8')
53
54
_zig() {
55
export MISSTYPE_ZIG="$srcdir/zig-$CARCH-linux-$_zig_version/zig"
56
}
57
58
pkgver() {
59
cd "$srcdir/misstype"
60
printf '0.1.r%s.g%s' "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
61
}
62
63
prepare() {
64
cd "$srcdir/misstype"
65
# Until the matching CMake fix is available in upstream Git.
66
if ! grep -q 'set(CMAKE_CXX_STANDARD 20)' linux/fcitx5/CMakeLists.txt; then
67
patch -Np1 -i "$srcdir/cxx20.patch"
68
fi
69
# Seed the upstream cache from makepkg's verified sources: no downloads
70
# during prepare/build/check. Upstream verifies the manifests again.
71
install -dm755 .cache/{mcbopomofo,naer,frequencywords}
72
install -m644 "$srcdir/"{BPMFBase.txt,BPMFMappings.txt,phrase.occ,heterophony{1,2,3}.list} .cache/mcbopomofo/
73
install -m644 "$srcdir/mcbopomofo-LICENSE.txt" .cache/mcbopomofo/LICENSE.txt
74
install -m644 "$srcdir/mcbopomofo-README.md" .cache/mcbopomofo/README.md
75
install -m644 "$srcdir/frequency.tsv" .cache/naer/
76
install -m644 "$srcdir/en_50k.txt" .cache/frequencywords/
77
python script/prepare_lexicon.py
78
}
79
80
build() {
81
cd "$srcdir/misstype"
82
_zig
83
# libMisstypeCAPI.so and misstypectl (settings/dictionary CLI).
84
bash script/linux/build_capi.sh
85
local capi_dir
86
capi_dir=$(cat build/capi/libdir)
87
cmake -S linux/fcitx5 -B build/arch -G Ninja \
88
-DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=/usr \
89
-DCMAKE_INSTALL_LIBDIR=lib -DMISSTYPE_CAPI_DIR="$capi_dir"
90
cmake --build build/arch
91
}
92
93
check() {
94
cd "$srcdir/misstype"
95
_zig
96
(cd core-zig && "$MISSTYPE_ZIG" build test -Doptimize=ReleaseFast)
97
bash script/linux/test_capi.sh
98
ctest --test-dir build/arch --output-on-failure
99
}
100
101
package() {
102
cd "$srcdir/misstype"
103
DESTDIR="$pkgdir" cmake --install build/arch
104
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
105
install -Dm644 THIRD_PARTY_NOTICES.md "$pkgdir/usr/share/licenses/$pkgname/THIRD_PARTY_NOTICES.md"
106
cp -a third_party "$pkgdir/usr/share/licenses/$pkgname/"
107
}
108
Changes since previous scan
--- PKGBUILD @ 2026-10-11 00:26+++ PKGBUILD @ 2026-10-17 00:21@@ -1,5 +1,5 @@ # Maintainer: PastLeo <chgu82837@gmail.com>-# AUR submission candidate; see docs/arch-linux.md.+# AUR packaging recipe; see docs/arch-linux.md. pkgname=fcitx5-misstype-git pkgver=0.1.r212.g5135a1f pkgrel=1Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-17 00:21:55 | Low | 3 |
| 2026-10-16 00:12:47 | Low | 3 |
| 2026-10-15 00:28:05 | Low | 3 |
| 2026-10-14 00:06:47 | Low | 3 |
| 2026-10-13 00:23:45 | Low | 3 |
| 2026-10-12 00:18:51 | Low | 3 |
| 2026-10-11 11:10:32 | Medium | 2 |
| 2026-10-11 00:26:05 | Low | 3 |
| 2026-10-10 10:13:47 | Medium | 2 |
| 2026-10-10 08:15:37 | Low | 3 |
| 2026-10-10 08:13:38 | Medium | 2 |