fushi

LOW

maintainer jmx4013 0 votes scanned 2026-09-01 11:49:32.090807

View on AUR

Why flagged

The Flutter SDK tarball is fetched from Google's official flutter_infra_release storage bucket (the canonical distribution channel for Flutter SDKs) with a pinned sha256 checksum, and the project source comes from its own GitHub repository; building from these sources is normal AUR practice with no obfuscated payloads, exfiltration, or unverifiable prebuilt executables from swappable hosts.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): The Flutter SDK tarball is fetched from Google's official flutter_infra_release storage bucket (the canonical distribution channel for Flutter SDKs) with a pinned sha256 checksum, and the project source comes from its own GitHub repository; building from these sources is normal AUR practice with no obfuscated payloads, exfiltration, or unverifiable prebuilt executables from swappable hosts.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 'https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.44.0-stable.tar.xz'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: jmx4013 <jmx4013@proton.me>
    
      2
    
      3pkgname=fushi
    
      4pkgver=2.1.1
    
      5pkgrel=3
    
      6pkgdesc='Immersion language-learning suite: EPUB reader, video subtitle lookup, audiobook sync, and one-tap Anki mining'
    
      7arch=('x86_64')
    
      8url='https://github.com/hajisensai/Fushi'
    
      9license=('GPL-3.0-or-later')
    
      10depends=('gtk3' 'libkeybinder3' 'mpv')
    
      11makedepends=('clang' 'cmake' 'ninja' 'pkg-config' 'unzip')
    
      12optdepends=('qbittorrent: fallback torrent engine when the bundled libtorrent is unavailable')
    
      13source=("https://github.com/hajisensai/Fushi/archive/refs/tags/v${pkgver}.tar.gz#/fushi-${pkgver}.tar.gz"
    
      14        'https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.44.0-stable.tar.xz'
    
      15        'fix-hoshidicts-includes.patch'
    
      16        'fushi.desktop')
    
      17sha256sums=('540e087ecdf33293a5cd8329049fcc7b05da5337429eb6db68ef650cbbaa4844'
    
      18            'e1ec95e6c550458a34de93580cb85dac24da0e9bedb9bb42811f050ac5a0c7d5'
    
      19            'ebaa703fe2bf866265c01d47e2bb2bf1195b654fce98fe7ad3ced2dfd8c81038'
    
      20            'd433c22716392af6845ad58ec5b243487c21076a7b1017d704ef84b14909afaf')
    
      21
    
      22prepare() {
    
      23  cd "${srcdir}/Fushi-${pkgver}"
    
      24  patch -p1 -i "${srcdir}/fix-hoshidicts-includes.patch"
    
      25}
    
      26
    
      27# Project is locked to Flutter 3.44.0 (the AUR flutter package is a different,
    
      28# older release), so the pinned SDK tarball is carried as a source. Dart SDK is
    
      29# bundled in that tarball; everything else resolves via pub.
    
      30#
    
      31# The v2.1.1 tag's pubspec still says 2.0.0+1210 (upstream stamps versions via
    
      32# CI flags, not pubspec), so without a fix the app would see itself as 2.0.0 and
    
      33# prompt an update to the manifest's 2.1.1 forever. flutter build --build-name/
    
      34# --build-number do NOT apply to Linux (version.json is generated from pubspec),
    
      35# so the bundle's data/flutter_assets/version.json is rewritten at package time
    
      36# to mirror the official desktop release: version=<pkgver>, build_number=9116
    
      37# (the releaseSequence of v2.1.1's latest-stable.json, which the in-app updater
    
      38# compares). Bump _release_seq together with pkgver when updating.
    
      39_release_seq=9116
    
      40build() {
    
      41  export FLUTTER_ROOT="${srcdir}/flutter"
    
      42  export PATH="${FLUTTER_ROOT}/bin:${PATH}"
    
      43  export PUB_CACHE="${srcdir}/pub-cache"
    
      44  cd "${srcdir}/Fushi-${pkgver}"
    
      45  bash tool/bootstrap.sh
    
      46  cd hibiki
    
      47  flutter build linux --release
    
      48}
    
      49
    
      50package() {
    
      51  local srcdir_app="${srcdir}/Fushi-${pkgver}"
    
      52  local bundle="${srcdir_app}/hibiki/build/linux/x64/release/bundle"
    
      53  local dest="${pkgdir}/usr/lib/fushi"
    
      54  install -dm755 "${dest}"
    
      55  cp -a "${bundle}/." "${dest}/"
    
      56  # Linux has no version pipeline: overwrite the pubspec-derived version.json
    
      57  # so PackageInfo (and thus the in-app updater) reports the real release.
    
      58  printf '{"app_name":"hibiki","version":"%s","build_number":"%s","package_name":"hibiki"}' \
    
      59    "${pkgver}" "${_release_seq}" > "${dest}/data/flutter_assets/version.json"
    
      60  install -Dm644 "${srcdir_app}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      61  install -Dm644 "${srcdir}/fushi.desktop" "${pkgdir}/usr/share/applications/fushi.desktop"
    
      62  install -Dm644 "${srcdir_app}/hibiki/android/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png" \
    
      63    "${pkgdir}/usr/share/pixmaps/fushi.png"
    
      64  # flutter_onnxruntime copies only the dev symlink (-> libonnxruntime.so.1);
    
      65  # the versioned real lib never lands in the bundle, so the bundle's symlink is
    
      66  # broken at runtime. Ship the real .so.1.22.0 into the same lib dir.
    
      67  local ort_lib
    
      68  ort_lib=$(find "${srcdir_app}/hibiki/build/linux/x64/release/plugins/flutter_onnxruntime" \
    
      69    -type d -path '*onnxruntime-linux-x64*/lib' | head -1)
    
      70  cp -a "${ort_lib}/." "${dest}/lib/"
    
      71}

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-01 11:49:32	Low	3
2026-09-01 11:47:58	Medium	2