fushi-beta

LOW

maintainer jmx4013 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package downloads the project's own source from GitHub and a Flutter SDK from Google's official infrastructure; both are legitimate build dependencies, and no untrusted or executable payloads are introduced.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads the project's own source from GitHub and a Flutter SDK from Google's official infrastructure; both are legitimate build dependencies, and no untrusted or executable payloads are introduced.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 'https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.44.0-stable.tar.xz'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: jmx4013 <jmx4013@proton.me>
    
      2# Beta track of the post-rename Fushi (v2.2.4-beta.13362). Conflicts with the
    
      3# stable `fushi` package; installs into the same /usr/lib/fushi layout.
    
      4
    
      5pkgname=fushi-beta
    
      6pkgver=2.7.0beta14929
    
      7pkgrel=1
    
      8pkgdesc='Immersion language-learning suite: EPUB reader, video subtitle lookup, audiobook sync, and one-tap Anki mining (beta)'
    
      9arch=('x86_64')
    
      10url='https://github.com/hajisensai/Fushi'
    
      11license=('GPL-3.0-or-later')
    
      12depends=('gtk3' 'libkeybinder3' 'mpv' 'wpewebkit')
    
      13conflicts=('fushi')
    
      14provides=('fushi')
    
      15makedepends=('clang' 'cmake' 'ninja' 'pkg-config' 'unzip' 'libwpe' 'wpebackend-fdo')
    
      16optdepends=('qbittorrent: fallback torrent engine when the bundled libtorrent is unavailable')
    
      17source=('https://github.com/hajisensai/Fushi/archive/refs/tags/v2.7.0-beta.14929.tar.gz#/fushi-2.7.0beta14929.tar.gz'
    
      18        'https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.44.0-stable.tar.xz'
    
      19        'fix-fushidicts-cstdint.patch'
    
      20        'wpe-inappwebview-linux.patch'
    
      21        'fushi.desktop')
    
      22sha256sums=('741acd68c4462891d17ff59fba415f5f4b32efdf760b87139319d0999ab997e9'
    
      23            'e1ec95e6c550458a34de93580cb85dac24da0e9bedb9bb42811f050ac5a0c7d5'
    
      24            '8334fd0a75f8cfdfff0873b3c9ae9f0d19acfffdf59c07d4cb4d95b1e3ed2391'
    
      25            'e610eb1629f86bb8812402681bd68503ca038423a684cb5fb037b4914450d83e'
    
      26            'c96cbc90cca94c8e7d661003e65b9206ae6f060a29f409e509f1f5b6393dc3ec')
    
      27
    
      28prepare() {
    
      29  cd "${srcdir}/Fushi-2.7.0-beta.14929"
    
      30  patch -p1 -i "${srcdir}/fix-fushidicts-cstdint.patch"
    
      31  patch -p1 -i "${srcdir}/wpe-inappwebview-linux.patch"
    
      32}
    
      33
    
      34build() {
    
      35  export FLUTTER_ROOT="${srcdir}/flutter"
    
      36  export PATH="${FLUTTER_ROOT}/bin:${PATH}"
    
      37  export PUB_CACHE="${srcdir}/pub-cache"
    
      38  cd "${srcdir}/Fushi-2.7.0-beta.14929"
    
      39  bash tool/bootstrap.sh
    
      40  cd fushi
    
      41  flutter build linux --release
    
      42}
    
      43
    
      44package() {
    
      45  local srcdir_app="${srcdir}/Fushi-2.7.0-beta.14929"
    
      46  local bundle="${srcdir_app}/fushi/build/linux/x64/release/bundle"
    
      47  local dest="${pkgdir}/usr/lib/fushi"
    
      48  install -dm755 "${dest}"
    
      49  cp -a "${bundle}/." "${dest}/"
    
      50  install -dm755 "${pkgdir}/usr/bin"
    
      51  ln -s /usr/lib/fushi/fushi "${pkgdir}/usr/bin/fushi"
    
      52  # Linux has no version pipeline: overwrite the pubspec-derived version.json
    
      53  # so PackageInfo (and thus the in-app updater) reports the beta release.
    
      54  printf '{"app_name":"fushi","version":"2.7.0-beta.14929","build_number":"14929","package_name":"fushi"}' > "${dest}/data/flutter_assets/version.json"
    
      55  install -Dm644 "${srcdir_app}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      56  install -Dm644 "${srcdir}/fushi.desktop" "${pkgdir}/usr/share/applications/fushi.desktop"
    
      57  install -Dm644 "${srcdir_app}/fushi/android/app/src/main/res/mipmap-xxxhdpi/ic_launcher.png" \
    
      58    "${pkgdir}/usr/share/pixmaps/fushi.png"
    
      59  # flutter_onnxruntime copies only the dev symlink (-> libonnxruntime.so.1);
    
      60  # the versioned real lib never lands in the bundle, so the bundle's symlink is
    
      61  # broken at runtime. Ship the real .so alongside.
    
      62  local ort_lib
    
      63  ort_lib=$(find "${srcdir_app}/fushi/build/linux/x64/release/plugins/flutter_onnxruntime" \
    
      64    -type d -path '*onnxruntime-linux-x64*/lib' | head -1)
    
      65  cp -a "${ort_lib}/." "${dest}/lib/"
    
      66}

Changes since previous scan

--- PKGBUILD @ 2026-10-05 00:08
+++ PKGBUILD @ 2026-10-17 00:21
@@ -22,7 +22,7 @@
 sha256sums=('741acd68c4462891d17ff59fba415f5f4b32efdf760b87139319d0999ab997e9'
             'e1ec95e6c550458a34de93580cb85dac24da0e9bedb9bb42811f050ac5a0c7d5'
             '8334fd0a75f8cfdfff0873b3c9ae9f0d19acfffdf59c07d4cb4d95b1e3ed2391'
-            '12157c9050b3d984803b59e2d4e1b344af4be4218b36a8c168b862d802ca1556'
+            'e610eb1629f86bb8812402681bd68503ca038423a684cb5fb037b4914450d83e'
             'c96cbc90cca94c8e7d661003e65b9206ae6f060a29f409e509f1f5b6393dc3ec')
 
 prepare() {
@@ -47,6 +47,8 @@
   local dest="${pkgdir}/usr/lib/fushi"
   install -dm755 "${dest}"
   cp -a "${bundle}/." "${dest}/"
+  install -dm755 "${pkgdir}/usr/bin"
+  ln -s /usr/lib/fushi/fushi "${pkgdir}/usr/bin/fushi"
   # Linux has no version pipeline: overwrite the pubspec-derived version.json
   # so PackageInfo (and thus the in-app updater) reports the beta release.
   printf '{"app_name":"fushi","version":"2.7.0-beta.14929","build_number":"14929","package_name":"fushi"}' > "${dest}/data/flutter_assets/version.json"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 00:11:52	Low	2
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 00:13:36	Low	2
2026-10-05 23:40:58	Medium	1
2026-10-05 00:08:03	Low	2
2026-10-04 00:18:08	Low	2
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2