floatlyrics

MEDIUM

maintainer nihildigit 1 votes scanned 2026-09-20 07:32:26.301293

View on AUR

Why flagged

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:30 "mecab-ipadic-2.7.0-20250920.tar.gz::https://lindera.dev/mecab-ipadic-2.7.0-20250920.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: ChouChiu
    
      2# SPDX-FileCopyrightText: 2026 ChouChiu
    
      3# SPDX-License-Identifier: AGPL-3.0-only
    
      4
    
      5pkgname=floatlyrics
    
      6pkgver=1.3.0
    
      7pkgrel=1
    
      8pkgdesc='Floating synchronized lyrics for MPRIS players on Linux Wayland'
    
      9arch=('x86_64')
    
      10url='https://github.com/ChouChiu/FloatLyrics'
    
      11license=('AGPL-3.0-only')
    
      12depends=(
    
      13    'cairo'
    
      14    'glib2'
    
      15    'glibc'
    
      16    'gtk4'
    
      17    'gtk4-layer-shell'
    
      18    'libgcc'
    
      19    'openssl'
    
      20    'pango'
    
      21    'sqlite'
    
      22    'webkitgtk-6.0'
    
      23)
    
      24makedepends=('bun' 'cargo')
    
      25# The other sources are the dictionaries `lindera-ipadic` and `lindera-cc-cedict`
    
      26# build the readings they embed into the binary from; pinned copies keep the build
    
      27# from fetching them on its own.
    
      28source=(
    
      29    "$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
    
      30    "mecab-ipadic-2.7.0-20250920.tar.gz::https://lindera.dev/mecab-ipadic-2.7.0-20250920.tar.gz"
    
      31    "CC-CEDICT-MeCab-0.1.0-20200409.tar.gz::https://lindera.dev/CC-CEDICT-MeCab-0.1.0-20200409.tar.gz"
    
      32)
    
      33# The source archive comes first, then the dictionaries in the order above;
    
      34# scripts/update-aur-checksum.sh replaces the first one on every release.
    
      35sha256sums=(
    
      36    'a7818983a078cfaa6f502e6bb7e2a8b38b24835659d297463f62fa87f3278ae8'
    
      37    'a7ba9f645ffe7094e56ae1c4a81d100df8fbb1e28bbe1792622e9728e162db3d'
    
      38    'ed3cf9e3ec8a80647f0ec783dc09dad43b8ccad2e994f5eab6ff13a41d0916c8'
    
      39)
    
      40# A lindera dictionary crate looks for its archive in
    
      41# "$LINDERA_BUILD_DICTIONARY_CACHE_DIR/<crate version>-fmt<dictionary format
    
      42# version>"; both numbers are pinned by Cargo.lock, and a mismatch falls back to
    
      43# the download the pinned copies are here to avoid.
    
      44dictionary_cache="$srcdir/lindera-cache"
    
      45dictionary_build="$dictionary_cache/6.0.0-fmt2"
    
      46export LINDERA_BUILD_DICTIONARY_CACHE_DIR="$dictionary_cache"
    
      47
    
      48prepare() {
    
      49    cd "FloatLyrics-$pkgver"
    
      50    export RUSTUP_TOOLCHAIN=stable
    
      51    cargo fetch --locked --target "$CARCH-unknown-linux-gnu"
    
      52    install -Dm644 "$srcdir/mecab-ipadic-2.7.0-20250920.tar.gz" \
    
      53        "$dictionary_build/mecab-ipadic-2.7.0-20250920.tar.gz"
    
      54    install -Dm644 "$srcdir/CC-CEDICT-MeCab-0.1.0-20200409.tar.gz" \
    
      55        "$dictionary_build/CC-CEDICT-MeCab-0.1.0-20200409.tar.gz"
    
      56}
    
      57
    
      58build() {
    
      59    cd "FloatLyrics-$pkgver"
    
      60    export RUSTUP_TOOLCHAIN=stable
    
      61    export LIBSQLITE3_SYS_USE_PKG_CONFIG=1
    
      62    CFLAGS+=" -ffat-lto-objects"
    
      63    export CFLAGS
    
      64    CARGO_TARGET_DIR=target cargo build --frozen --release
    
      65}
    
      66
    
      67check() {
    
      68    cd "FloatLyrics-$pkgver"
    
      69    export RUSTUP_TOOLCHAIN=stable
    
      70    export LIBSQLITE3_SYS_USE_PKG_CONFIG=1
    
      71    CFLAGS+=" -ffat-lto-objects"
    
      72    export CFLAGS
    
      73    CARGO_TARGET_DIR=target cargo test --frozen --all-targets --all-features
    
      74}
    
      75
    
      76package() {
    
      77    cd "FloatLyrics-$pkgver"
    
      78    ./packaging/install.sh "$pkgdir" target/release/floatlyrics
    
      79}
    
      80

Changes since previous scan

--- PKGBUILD @ 2026-09-06 13:11
+++ PKGBUILD @ 2026-09-20 07:32
@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: AGPL-3.0-only
 
 pkgname=floatlyrics
-pkgver=1.2.0
+pkgver=1.3.0
 pkgrel=1
 pkgdesc='Floating synchronized lyrics for MPRIS players on Linux Wayland'
 arch=('x86_64')
@@ -22,15 +22,37 @@
     'webkitgtk-6.0'
 )
 makedepends=('bun' 'cargo')
-source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
-# Replace SKIP with the v1.0.0 source archive checksum before publishing to AUR:
-#   updpkgsums && makepkg --printsrcinfo > .SRCINFO
-sha256sums=('a5385618a11e9b78f546d6860109f2c209d4825c1b27c6798695cbf245a0c677')
+# The other sources are the dictionaries `lindera-ipadic` and `lindera-cc-cedict`
+# build the readings they embed into the binary from; pinned copies keep the build
+# from fetching them on its own.
+source=(
+    "$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
+    "mecab-ipadic-2.7.0-20250920.tar.gz::https://lindera.dev/mecab-ipadic-2.7.0-20250920.tar.gz"
+    "CC-CEDICT-MeCab-0.1.0-20200409.tar.gz::https://lindera.dev/CC-CEDICT-MeCab-0.1.0-20200409.tar.gz"
+)
+# The source archive comes first, then the dictionaries in the order above;
+# scripts/update-aur-checksum.sh replaces the first one on every release.
+sha256sums=(
+    'a7818983a078cfaa6f502e6bb7e2a8b38b24835659d297463f62fa87f3278ae8'
+    'a7ba9f645ffe7094e56ae1c4a81d100df8fbb1e28bbe1792622e9728e162db3d'
+    'ed3cf9e3ec8a80647f0ec783dc09dad43b8ccad2e994f5eab6ff13a41d0916c8'
+)
+# A lindera dictionary crate looks for its archive in
+# "$LINDERA_BUILD_DICTIONARY_CACHE_DIR/<crate version>-fmt<dictionary format
+# version>"; both numbers are pinned by Cargo.lock, and a mismatch falls back to
+# the download the pinned copies are here to avoid.
+dictionary_cache="$srcdir/lindera-cache"
+dictionary_build="$dictionary_cache/6.0.0-fmt2"
+export LINDERA_BUILD_DICTIONARY_CACHE_DIR="$dictionary_cache"
 
 prepare() {
     cd "FloatLyrics-$pkgver"
     export RUSTUP_TOOLCHAIN=stable
     cargo fetch --locked --target "$CARCH-unknown-linux-gnu"
+    install -Dm644 "$srcdir/mecab-ipadic-2.7.0-20250920.tar.gz" \
+        "$dictionary_build/mecab-ipadic-2.7.0-20250920.tar.gz"
+    install -Dm644 "$srcdir/CC-CEDICT-MeCab-0.1.0-20200409.tar.gz" \
+        "$dictionary_build/CC-CEDICT-MeCab-0.1.0-20200409.tar.gz"
 }
 
 build() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-20 07:32:26	Medium	1
2026-09-06 13:11:32	Clean	0
2026-07-21 00:24:15	Clean	2
2026-07-20 19:14:42	Low	1
2026-07-20 00:19:49	Clean	2
2026-07-19 07:10:24	Low	1
2026-07-18 00:14:48	Clean	2
2026-07-17 15:55:03	Low	1
2026-07-14 00:09:48	Clean	2
2026-07-13 11:41:15	Low	1
2026-07-13 00:19:36	Clean	2
2026-07-12 13:40:04	Low	1
2026-07-12 09:39:43	Low	1