gnome-shell-extension-copyous
LOW
maintainer supermario
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a minified JavaScript file (highlight.min.js) from cdnjs.cloudflare.com, a legitimate public CDN; while not the project's primary host, it is a trusted source for common libraries, and the file is used as a static dependency without execution at build/install time, posing minimal risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a minified JavaScript file (highlight.min.js) from cdnjs.cloudflare.com, a legitimate public CDN; while not the project's primary host, it is a trusted source for common libraries, and the file is used as a static dependency without execution at build/install time, posing minimal risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
https://cdnjs.cloudflare.com/ajax/libs/highlight.js/${_highlightver}/es/highlight.min.js)
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Mario Finelli <mario at finel dot li>
2
3
# this should match the version listed in src/lib/common/constants.ts
4
_highlightver=11.11.1
5
6
pkgname=gnome-shell-extension-copyous
7
pkgver=2.1.2
8
pkgrel=1
9
pkgdesc="Modern Clipboard Manager for GNOME"
10
arch=(any)
11
url=https://github.com/boerdereinar/copyous
12
license=(GPL-3.0-or-later)
13
depends=(gnome-shell libgda6 gsound)
14
makedepends=(git jq meson nodejs pnpm uv)
15
source=("$pkgname::git+$url.git#tag=v$pkgver"
16
https://cdnjs.cloudflare.com/ajax/libs/highlight.js/${_highlightver}/es/highlight.min.js)
17
sha256sums=('68a75670457a0fc1ddc6333fc943a106c3a54e1a504e048743a10ac8356ea2c5'
18
'7865839949f0764d9e0a21e311a4e2c42633eeaee8ca5ec127b86438565731fe')
19
20
prepare() {
21
cd $pkgname
22
23
git submodule update --init
24
25
# remove the install script so that it doesn't automatically call
26
# "make install"
27
sed -i '/"install":/d' package.json
28
29
pnpm install --frozen-lockfile
30
}
31
32
build() {
33
cd $pkgname
34
35
(
36
cd submodules/gnome-shell/subprojects/extensions-tool
37
./generate-translations.sh
38
meson setup --buildtype=release -Dman=false build
39
meson compile -C build
40
)
41
42
RELEASE=1 make build
43
}
44
45
package() {
46
cd $pkgname/dist
47
48
local uuid=$(grep -Po '(?<="uuid": ")[^"]*' metadata.json)
49
local schema=$(grep -Po '(?<="settings-schema": ")[^"]*' metadata.json).gschema.xml
50
local destdir="${pkgdir}/usr/share/gnome-shell/extensions/${uuid}"
51
52
install -d "${destdir}"
53
bsdtar xvf ${uuid}.zip -C "$pkgdir/usr/share/gnome-shell/extensions/${uuid}/" --no-same-owner
54
install -Dm0644 "schemas/${schema}" -t "${pkgdir}/usr/share/glib-2.0/schemas/"
55
install -Dm0644 "${srcdir}/highlight.min.js" "${destdir}/highlight.min.js"
56
57
rm -rf "${destdir}/schemas"
58
}
59
60
# vim: set ts=2 sw=2 et:
61
Changes since previous scan
--- PKGBUILD @ 2026-10-19 00:03+++ PKGBUILD @ 2026-11-01 00:21@@ -4,7 +4,7 @@ _highlightver=11.11.1 pkgname=gnome-shell-extension-copyous-pkgver=2.1.0+pkgver=2.1.2 pkgrel=1 pkgdesc="Modern Clipboard Manager for GNOME" arch=(any)@@ -14,7 +14,7 @@ makedepends=(git jq meson nodejs pnpm uv) source=("$pkgname::git+$url.git#tag=v$pkgver" https://cdnjs.cloudflare.com/ajax/libs/highlight.js/${_highlightver}/es/highlight.min.js)-sha256sums=('33fef54b2ae2508b4d42e61dd60f2926a3a3a626a2fc58e9f145fecee302e0bd'+sha256sums=('68a75670457a0fc1ddc6333fc943a106c3a54e1a504e048743a10ac8356ea2c5' '7865839949f0764d9e0a21e311a4e2c42633eeaee8ca5ec127b86438565731fe') prepare() {Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 13:25:12 | Medium | 1 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |