fushi

LOW

maintainer jmx4013 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package downloads a Flutter SDK tarball from Google's official infrastructure and the project's own source from GitHub; both are legitimate build dependencies, and no untrusted or executable payloads are introduced.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a Flutter SDK tarball from Google's official infrastructure and the project's own source from GitHub; both are legitimate build dependencies, and no untrusted or executable payloads are introduced.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 'https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.44.0-stable.tar.xz'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: jmx4013 <jmx4013@proton.me>
    
      2
    
      3pkgname=fushi
    
      4pkgver=2.9.1
    
      5pkgrel=1
    
      6pkgdesc='Immersion language-learning suite: EPUB reader, video subtitle lookup, audiobook sync, and one-tap Anki mining'
    
      7arch=('x86_64')
    
      8url='https://github.com/hajisensai/Fushi'
    
      9license=('GPL-3.0-or-later')
    
      10depends=('gtk3' 'libkeybinder3' 'mpv' 'wpewebkit')
    
      11makedepends=('clang' 'cmake' 'ninja' 'pkg-config' 'unzip' 'libwpe' 'wpebackend-fdo')
    
      12optdepends=('qbittorrent: fallback torrent engine when the bundled libtorrent is unavailable')
    
      13source=("https://github.com/hajisensai/Fushi/archive/refs/tags/v2.9.1.tar.gz#/fushi-2.9.1.tar.gz"
    
      14        'https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.44.0-stable.tar.xz'
    
      15        'fix-fushidicts-cstdint.patch'
    
      16        'wpe-inappwebview-linux.patch'
    
      17        'fushi.desktop')
    
      18sha256sums=('2a97c7e4cd4d96b5d41e48574003864957fab8b2243d232fcd900d9814404133'
    
      19            'e1ec95e6c550458a34de93580cb85dac24da0e9bedb9bb42811f050ac5a0c7d5'
    
      20            '8334fd0a75f8cfdfff0873b3c9ae9f0d19acfffdf59c07d4cb4d95b1e3ed2391'
    
      21            '12157c9050b3d984803b59e2d4e1b344af4be4218b36a8c168b862d802ca1556'
    
      22            'c96cbc90cca94c8e7d661003e65b9206ae6f060a29f409e509f1f5b6393dc3ec')
    
      23
    
      24prepare() {
    
      25  cd "${srcdir}/Fushi-${pkgver}"
    
      26  patch -p1 -i "${srcdir}/fix-fushidicts-cstdint.patch"
    
      27  patch -p1 -i "${srcdir}/wpe-inappwebview-linux.patch"
    
      28}
    
      29
    
      30# Project is locked to Flutter 3.44.0 (the AUR flutter package is a different,
    
      31# older release), so the pinned SDK tarball is carried as a source. Dart SDK is
    
      32# bundled in that tarball; everything else resolves via pub.
    
      33#
    
      34# The v2.1.1 tag's pubspec still says 2.0.0+1210 (upstream stamps versions via
    
      35# CI flags, not pubspec), so without a fix the app would see itself as 2.0.0 and
    
      36# prompt an update to the manifest's 2.1.1 forever. flutter build --build-name/
    
      37# --build-number do NOT apply to Linux (version.json is generated from pubspec),
    
      38# so the bundle's data/flutter_assets/version.json is rewritten at package time
    
      39# to mirror the official desktop release: version=<pkgver>, build_number=<seq>
    
      40# (the releaseSequence of latest-stable-fushi.json, which the in-app updater
    
      41# compares). Bump _release_seq together with pkgver when updating.
    
      42_release_seq=16909
    
      43build() {
    
      44  export FLUTTER_ROOT="${srcdir}/flutter"
    
      45  export PATH="${FLUTTER_ROOT}/bin:${PATH}"
    
      46  export PUB_CACHE="${srcdir}/pub-cache"
    
      47  cd "${srcdir}/Fushi-${pkgver}"
    
      48  bash tool/bootstrap.sh
    
      49  cd fushi
    
      50  flutter build linux --release
    
      51}
    
      52
    
      53package() {
    
      54  local srcdir_app="${srcdir}/Fushi-${pkgver}"
    
      55  local bundle="${srcdir_app}/fushi/build/linux/x64/release/bundle"
    
      56  local dest="${pkgdir}/usr/lib/fushi"
    
      57  install -dm755 "${dest}"
    
      58  cp -a "${bundle}/." "${dest}/"
    
      59  # Linux has no version pipeline: overwrite the pubspec-derived version.json
    
      60  # so PackageInfo (and thus the in-app updater) reports the real release.
    
      61  printf '{"app_name":"fushi","version":"2.9.1","build_number":"16909","package_name":"fushi"}' > "${dest}/data/flutter_assets/version.json"
    
      62  install -Dm644 "${srcdir_app}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      63  install -Dm644 "${srcdir}/fushi.desktop" "${pkgdir}/usr/share/applications/fushi.desktop"
    
      64  install -Dm644 "${srcdir_app}/fushi/android/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png" \
    
      65    "${pkgdir}/usr/share/pixmaps/fushi.png"
    
      66  # flutter_onnxruntime copies only the dev symlink (-> libonnxruntime.so.1);
    
      67  # the versioned real lib never lands in the bundle, so the bundle's symlink is
    
      68  # broken at runtime. Ship the real .so.1.22.0 into the same lib dir.
    
      69  local ort_lib
    
      70  ort_lib=$(find "${srcdir_app}/fushi/build/linux/x64/release/plugins/flutter_onnxruntime" \
    
      71    -type d -path '*onnxruntime-linux-x64*/lib' | head -1)
    
      72  cp -a "${ort_lib}/." "${dest}/lib/"
    
      73}

Changes since previous scan

--- PKGBUILD @ 2026-10-05 00:08
+++ PKGBUILD @ 2026-10-17 00:21
@@ -1,7 +1,7 @@
 # Maintainer: jmx4013 <jmx4013@proton.me>
 
 pkgname=fushi
-pkgver=2.7.0
+pkgver=2.9.1
 pkgrel=1
 pkgdesc='Immersion language-learning suite: EPUB reader, video subtitle lookup, audiobook sync, and one-tap Anki mining'
 arch=('x86_64')
@@ -10,15 +10,15 @@
 depends=('gtk3' 'libkeybinder3' 'mpv' 'wpewebkit')
 makedepends=('clang' 'cmake' 'ninja' 'pkg-config' 'unzip' 'libwpe' 'wpebackend-fdo')
 optdepends=('qbittorrent: fallback torrent engine when the bundled libtorrent is unavailable')
-source=("https://github.com/hajisensai/Fushi/archive/refs/tags/v2.7.0.tar.gz#/fushi-2.7.0.tar.gz"
+source=("https://github.com/hajisensai/Fushi/archive/refs/tags/v2.9.1.tar.gz#/fushi-2.9.1.tar.gz"
         'https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.44.0-stable.tar.xz'
         'fix-fushidicts-cstdint.patch'
         'wpe-inappwebview-linux.patch'
         'fushi.desktop')
-sha256sums=('668cad81312c380b1c64bd2720de8060101dffec8b9ea91d64c98e016e985317'
+sha256sums=('2a97c7e4cd4d96b5d41e48574003864957fab8b2243d232fcd900d9814404133'
             'e1ec95e6c550458a34de93580cb85dac24da0e9bedb9bb42811f050ac5a0c7d5'
             '8334fd0a75f8cfdfff0873b3c9ae9f0d19acfffdf59c07d4cb4d95b1e3ed2391'
-            '5d5398be837f9b6d108f62c93c98b6f0eaa6048c0da40e4dd7062b3ecdef5b3e'
+            '12157c9050b3d984803b59e2d4e1b344af4be4218b36a8c168b862d802ca1556'
             'c96cbc90cca94c8e7d661003e65b9206ae6f060a29f409e509f1f5b6393dc3ec')
 
 prepare() {
@@ -39,7 +39,7 @@
 # to mirror the official desktop release: version=<pkgver>, build_number=<seq>
 # (the releaseSequence of latest-stable-fushi.json, which the in-app updater
 # compares). Bump _release_seq together with pkgver when updating.
-_release_seq=14872
+_release_seq=16909
 build() {
   export FLUTTER_ROOT="${srcdir}/flutter"
   export PATH="${FLUTTER_ROOT}/bin:${PATH}"
@@ -58,7 +58,7 @@
   cp -a "${bundle}/." "${dest}/"
   # Linux has no version pipeline: overwrite the pubspec-derived version.json
   # so PackageInfo (and thus the in-app updater) reports the real release.
-  printf '{"app_name":"fushi","version":"2.7.0","build_number":"14872","package_name":"fushi"}' > "${dest}/data/flutter_assets/version.json"
+  printf '{"app_name":"fushi","version":"2.9.1","build_number":"16909","package_name":"fushi"}' > "${dest}/data/flutter_assets/version.json"
   install -Dm644 "${srcdir_app}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
   install -Dm644 "${srcdir}/fushi.desktop" "${pkgdir}/usr/share/applications/fushi.desktop"
   install -Dm644 "${srcdir_app}/fushi/android/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png" \

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 00:11:52	Low	2
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 00:13:36	Low	2
2026-10-05 23:40:58	Medium	1
2026-10-05 00:08:03	Low	2
2026-10-04 00:18:08	Low	2
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2