freeturn-desktop-git

LOW

maintainer outrage 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package builds from a legitimate project Git repository with no remote code execution, obfuscated downloads, or untrusted prebuilt binaries; the low severity is due to few votes and recent upload, not inherent risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a legitimate project Git repository with no remote code execution, obfuscated downloads, or untrusted prebuilt binaries; the low severity is due to few votes and recent upload, not inherent risk.

PKGBUILD

      1# Maintainer: FreeTurn contributors <https://gitlab.com/freeturn/freeturn-desktop>
    
      2# Live git build of the FreeTurn desktop client (Wails v2 + Go + React).
    
      3#
    
      4# This directory is AUR-ready: to publish, copy its contents (PKGBUILD,
    
      5# .SRCINFO, *.install) into an empty `freeturn-desktop-git` AUR repository
    
      6# and push. See README.md next to this file for the maintainer checklist.
    
      7
    
      8pkgname=freeturn-desktop-git
    
      9pkgver=r6.bca9d5b
    
      10pkgrel=1
    
      11pkgdesc='FreeTurn VPN client - git build'
    
      12arch=('x86_64')
    
      13url='https://gitlab.com/freeturn/freeturn-desktop'
    
      14license=('Unlicense')
    
      15depends=(
    
      16  'gtk3'
    
      17  'webkit2gtk-4.1'
    
      18  'libayatana-appindicator'
    
      19)
    
      20makedepends=(
    
      21  'gcc'
    
      22  'git'
    
      23  'go'
    
      24  'nodejs'
    
      25  'npm'
    
      26  'pkgconf'
    
      27)
    
      28optdepends=(
    
      29  'iproute2: TUN addresses, routes and policy routing at connect time'
    
      30  'iptables: per-app UID rules and cgroup-v2 bypass on Linux'
    
      31  'polkit: pkexec elevation prompt for one-click service install'
    
      32  'systemd: system-service install backend'
    
      33)
    
      34provides=('freeturn-desktop')
    
      35conflicts=('freeturn-desktop' 'freeturn-desktop-bin')
    
      36install='freeturn-desktop-git.install'
    
      37source=("$pkgname::git+https://gitlab.com/freeturn/freeturn-desktop.git")
    
      38sha256sums=('SKIP')
    
      39
    
      40pkgver() {
    
      41  cd "$pkgname"
    
      42  printf 'r%s.%s' "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      43}
    
      44
    
      45build() {
    
      46  cd "$pkgname"
    
      47
    
      48  # Arch Go package guidelines: honor the system CFLAGS/LDFLAGS, build
    
      49  # position-independent, strip build paths, keep modules read-only, and
    
      50  # keep all caches inside srcdir so clean chroots stay tidy.
    
      51  export CGO_CPPFLAGS="${CPPFLAGS}"
    
      52  export CGO_CFLAGS="${CFLAGS}"
    
      53  export CGO_CXXFLAGS="${CXXFLAGS}"
    
      54  export CGO_LDFLAGS="${LDFLAGS}"
    
      55  export GOFLAGS='-buildmode=pie -trimpath -mod=readonly -modcacherw'
    
      56  export GOPATH="$srcdir/gopath"
    
      57  export GOCACHE="$srcdir/gocache"
    
      58  export npm_config_cache="$srcdir/npm-cache"
    
      59
    
      60  # main.go embeds frontend/dist, so the frontend builds first. package-lock.json
    
      61  # is committed, hence reproducible `npm ci` (needs devDependencies: vite, tsc).
    
      62  npm ci --prefix frontend
    
      63  npm --prefix frontend run build
    
      64
    
      65  # Wails' cgo defaults to pkg-config webkit2gtk-4.0, which no longer exists on
    
      66  # Arch (only webkit2gtk-4.1 is shipped); webkit2_41 opts into the 4.1 API.
    
      67  # desktop,production are the tags `wails build` uses. The version stamp feeds
    
      68  # both `--version` and Settings (backend.AppVersion via App.Version()).
    
      69  go build \
    
      70    -tags desktop,production,webkit2_41 \
    
      71    -ldflags "-linkmode=external -X main.version=$pkgver" \
    
      72    -o build/bin/freeturn-desktop \
    
      73    .
    
      74}
    
      75
    
      76check() {
    
      77  cd "$pkgname"
    
      78  export GOPATH="$srcdir/gopath"
    
      79  export GOCACHE="$srcdir/gocache"
    
      80  export GOFLAGS='-mod=readonly -modcacherw'
    
      81  # Same tags as build(): the test binary links main -> the Wails Linux
    
      82  # frontend, so it needs webkit2_41 for the exact same cgo reason.
    
      83  go test -tags desktop,production,webkit2_41 ./...
    
      84}
    
      85
    
      86package() {
    
      87  cd "$pkgname"
    
      88  install -Dm755 build/bin/freeturn-desktop "$pkgdir/usr/bin/freeturn-desktop"
    
      89  install -Dm644 build/linux/freeturn.desktop "$pkgdir/usr/share/applications/freeturn-desktop.desktop"
    
      90  install -Dm644 build/appicon.png "$pkgdir/usr/share/icons/hicolor/512x512/apps/freeturn-desktop.png"
    
      91  # Unlicense is not in /usr/share/licenses/common, so ship the repo copy.
    
      92  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      93}
    
      94

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 00:11:52	Low	2
2026-10-09 14:11:17	Low	2