fungw

LOW

maintainer orphaned 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is hosted on the project's official domain (repo.hu), which is plausibly the project's own infrastructure; building from a non-whitelisted but legitimate project host is normal for AUR packages and does not constitute a significant supply-chain risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is hosted on the project's official domain (repo.hu), which is plausibly the project's own infrastructure; building from a non-whitelisted but legitimate project host is normal for AUR packages and does not constitute a significant supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("http://www.repo.hu/projects/$pkgname/releases/$pkgname-$pkgver.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: CuVoodoo <pcb-rnd@cuvoodoo.info>
    
      2pkgname=fungw
    
      3pkgver=1.2.1
    
      4pkgrel=1
    
      5pkgdesc="tiny, portable library written in C (C89) that manages dynamic function calls across different programming languages"
    
      6url="http://www.repo.hu/projects/fungw/"
    
      7arch=('i686' 'x86_64')
    
      8license=('LGPL2')
    
      9depends=('genht')
    
      10# fungw is not strictly dependant on genht (it also embeds it), but other packages relying on fungw also can optionally use external genht, and we don't want them to use different versions
    
      11optdepends=('lua' 'perl' 'tcl' 'python2' 'python' 'duktape' 'mujs' 'libmawk>=1.0.3')
    
      12# picolisp could not compile
    
      13# there is no estutter package
    
      14# there is no funlist package
    
      15# compilation against mruby fails because mruby is missing the -fPIC compile flag
    
      16source=("http://www.repo.hu/projects/$pkgname/releases/$pkgname-$pkgver.tar.gz")
    
      17sha256sums=('dd1266713a3f8e0f86fe8942c5e565b786a3bffe42b331a6023d56c22ff002ae')
    
      18
    
      19build() {
    
      20  cd "$srcdir/$pkgname-$pkgver/"
    
      21  ./configure --prefix=/usr
    
      22  make
    
      23}
    
      24
    
      25package() {
    
      26  cd "$srcdir/$pkgname-$pkgver/"
    
      27  make DESTDIR="$pkgdir/" install
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2