gnome-shell-frippery

maintainer envolution · 64 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a tarball from the project's own domain, frippery.org, which hosts the extensions; building from this source is normal for the package and the worst case of a swapped source is limited to code execution within the extension's scope, but the host is plausibly legitimate and the package otherwise follows standard AUR practices.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the project's own domain, frippery.org, which hosts the extensions; building from this source is normal for the package and the worst case of a swapped source is limited to code execution within the extension's scope, but the host is plausibly legitimate and the package otherwise follows standard AUR practices.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("http://frippery.org/extensions/${pkgname}-${pkgver}.tgz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: envolution
    
      2# Contributor: Brian Thompson <brianrobt@pm.me>
    
      3# Contributor: Christian Brassat <christian.brassat@gmail.com>
    
      4# shellcheck shell=bash disable=SC2034,SC2154
    
      5
    
      6pkgname=gnome-shell-frippery
    
      7pkgver=49.0
    
      8pkgrel=1
    
      9pkgdesc='Gnome Shell extensions to make Gnome 3 more like Gnome 2'
    
      10arch=('any')
    
      11url='http://frippery.org/extensions/index.html'
    
      12license=('GPL2')
    
      13depends=('gnome-shell>=46.0')
    
      14makedepends=()
    
      15source=("http://frippery.org/extensions/${pkgname}-${pkgver}.tgz")
    
      16sha256sums=('4044653f052548189535ad7cd3531ceaa77a7a4c0d11636e738915dea1be3d87')
    
      17
    
      18package() {
    
      19  cd .local
    
      20  rm -r share/gnome-shell/gnome-shell-frippery
    
      21  mkdir -p $pkgdir/usr
    
      22  cp -r share $pkgdir/usr/
    
      23}
    
      24# vim:set ts=2 sw=2 et:
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2