fushi-beta

LOW

maintainer jmx4013 0 votes scanned 2026-09-01 13:50:40.273966

View on AUR

Why flagged

Sources are from the project's own GitHub repo and Google's official Flutter infrastructure (storage.googleapis.com/flutter_infra_release), both plausible official origins; the build compiles from source using the Flutter SDK; no obfuscation, exfiltration, or remote code execution patterns are present, though the package is new with few votes and bundles a Flutter SDK download.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Sources are from the project's own GitHub repo and Google's official Flutter infrastructure (storage.googleapis.com/flutter_infra_release), both plausible official origins; the build compiles from source using the Flutter SDK; no obfuscation, exfiltration, or remote code execution patterns are present, though the package is new with few votes and bundles a Flutter SDK download.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 'https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.44.0-stable.tar.xz'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: jmx4013 <jmx4013@proton.me>
    
      2# Beta track of the post-rename Fushi (v2.2.1-beta.12447). Conflicts with the
    
      3# stable `fushi` package; installs into the same /usr/lib/fushi layout.
    
      4
    
      5pkgname=fushi-beta
    
      6pkgver=2.2.1beta12447
    
      7pkgrel=1
    
      8pkgdesc='Immersion language-learning suite: EPUB reader, video subtitle lookup, audiobook sync, and one-tap Anki mining (beta)'
    
      9arch=('x86_64')
    
      10url='https://github.com/hajisensai/Fushi'
    
      11license=('GPL-3.0-or-later')
    
      12depends=('gtk3' 'libkeybinder3' 'mpv')
    
      13conflicts=('fushi')
    
      14provides=('fushi')
    
      15makedepends=('clang' 'cmake' 'ninja' 'pkg-config' 'unzip')
    
      16optdepends=('qbittorrent: fallback torrent engine when the bundled libtorrent is unavailable')
    
      17source=('https://github.com/hajisensai/Fushi/archive/refs/tags/v2.2.1-beta.12447.tar.gz#/fushi-beta.tar.gz'
    
      18        'https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.44.0-stable.tar.xz'
    
      19        'fix-fushidicts-cstdint.patch'
    
      20        'fushi.desktop')
    
      21sha256sums=('eea634dcda2dc6edd8a179a64169927781301f369b5338f62f743a4c51ccefd0'
    
      22            'e1ec95e6c550458a34de93580cb85dac24da0e9bedb9bb42811f050ac5a0c7d5'
    
      23            '8334fd0a75f8cfdfff0873b3c9ae9f0d19acfffdf59c07d4cb4d95b1e3ed2391'
    
      24            'c96cbc90cca94c8e7d661003e65b9206ae6f060a29f409e509f1f5b6393dc3ec')
    
      25
    
      26prepare() {
    
      27  cd "${srcdir}/Fushi-2.2.1-beta.12447"
    
      28  patch -p1 -i "${srcdir}/fix-fushidicts-cstdint.patch"
    
      29}
    
      30
    
      31build() {
    
      32  export FLUTTER_ROOT="${srcdir}/flutter"
    
      33  export PATH="${FLUTTER_ROOT}/bin:${PATH}"
    
      34  export PUB_CACHE="${srcdir}/pub-cache"
    
      35  cd "${srcdir}/Fushi-2.2.1-beta.12447"
    
      36  bash tool/bootstrap.sh
    
      37  cd fushi
    
      38  flutter build linux --release
    
      39}
    
      40
    
      41package() {
    
      42  local srcdir_app="${srcdir}/Fushi-2.2.1-beta.12447"
    
      43  local bundle="${srcdir_app}/fushi/build/linux/x64/release/bundle"
    
      44  local dest="${pkgdir}/usr/lib/fushi"
    
      45  install -dm755 "${dest}"
    
      46  cp -a "${bundle}/." "${dest}/"
    
      47  # Linux has no version pipeline: overwrite the pubspec-derived version.json
    
      48  # so PackageInfo (and thus the in-app updater) reports the beta release.
    
      49  printf '{"app_name":"fushi","version":"2.2.1-beta.12447","build_number":"12447","package_name":"fushi"}' \
    
      50    > "${dest}/data/flutter_assets/version.json"
    
      51  install -Dm644 "${srcdir_app}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      52  install -Dm644 "${srcdir}/fushi.desktop" "${pkgdir}/usr/share/applications/fushi.desktop"
    
      53  install -Dm644 "${srcdir_app}/fushi/android/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png" \
    
      54    "${pkgdir}/usr/share/pixmaps/fushi.png"
    
      55  # flutter_onnxruntime copies only the dev symlink (-> libonnxruntime.so.1);
    
      56  # the versioned real lib never lands in the bundle, so the bundle's symlink is
    
      57  # broken at runtime. Ship the real .so alongside.
    
      58  local ort_lib
    
      59  ort_lib=$(find "${srcdir_app}/fushi/build/linux/x64/release/plugins/flutter_onnxruntime" \
    
      60    -type d -path '*onnxruntime-linux-x64*/lib' | head -1)
    
      61  cp -a "${ort_lib}/." "${dest}/lib/"
    
      62}

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-01 13:50:40	Low	3
2026-09-01 13:48:42	Medium	2