grabit-git
LOW
maintainer creations
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The source is a git repository hosted on a personal domain, but it is the project's own upstream source, and building from git is normal for -git AUR packages; the non-whitelisted host is not inherently dangerous in this context.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The source is a git repository hosted on a personal domain, but it is the project's own upstream source, and building from git is normal for -git AUR packages; the non-whitelisted host is not inherently dangerous in this context.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:36
source=("grabit::git+https://heliopolis.live/creations/grabit.git#branch=main")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: creations <creations@creations.works>
2
pkgname=grabit-git
3
pkgver=0.7.0.r294.gb1f787b
4
pkgrel=1
5
pkgdesc="Screenshot, screen-recording, OCR, and uploader for wlroots and KDE Plasma 6 Wayland compositors (git)"
6
arch=('x86_64' 'aarch64')
7
url="https://heliopolis.live/creations/grabit"
8
license=('AGPL-3.0-or-later')
9
depends=(
10
'cairo'
11
'curl'
12
'dbus'
13
'file'
14
'json-c'
15
'libxkbcommon'
16
'wayland'
17
)
18
makedepends=(
19
'git'
20
'wayland-protocols'
21
)
22
optdepends=(
23
'ffmpeg: --record support'
24
'tesseract: --tesseract (OCR) support'
25
'tesseract-data-eng: english OCR data'
26
'translate-shell: --translate (OCR -> translated text) support'
27
'libjpeg-turbo: JPEG output (--format jpeg)'
28
'libwebp: WebP output (--format webp)'
29
'pipewire: pw-play (default shutter-sound player)'
30
'libpulse: paplay (alternative sound player)'
31
'alsa-utils: aplay (alternative sound player)'
32
'sox: play (alternative sound player)'
33
)
34
provides=("grabit=${pkgver%%.r*}")
35
conflicts=('grabit' 'grabit-bin')
36
source=("grabit::git+https://heliopolis.live/creations/grabit.git#branch=main")
37
sha256sums=('SKIP')
38
39
pkgver() {
40
cd "${srcdir}/grabit"
41
printf "%s.r%s.g%s" \
42
"$(awk '/^VERSION/ {print $3; exit}' Makefile)" \
43
"$(git rev-list --count HEAD)" \
44
"$(git rev-parse --short HEAD)"
45
}
46
47
build() {
48
cd "${srcdir}/grabit"
49
make all VERSION="${pkgver%.r*}"
50
}
51
52
package() {
53
cd "${srcdir}/grabit"
54
make install DESTDIR="${pkgdir}" PREFIX="/usr"
55
install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
56
install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
57
install -Dm644 OPTIONS.md "${pkgdir}/usr/share/doc/${pkgname}/OPTIONS.md"
58
install -Dm644 PLUGINS.md "${pkgdir}/usr/share/doc/${pkgname}/PLUGINS.md"
59
}
60
Changes since previous scan
--- PKGBUILD @ 2026-09-11 00:19+++ PKGBUILD @ 2026-09-17 00:27@@ -1,6 +1,6 @@ # Maintainer: creations <creations@creations.works> pkgname=grabit-git-pkgver=0.7.0.r284.ge605248+pkgver=0.7.0.r294.gb1f787b pkgrel=1 pkgdesc="Screenshot, screen-recording, OCR, and uploader for wlroots and KDE Plasma 6 Wayland compositors (git)" arch=('x86_64' 'aarch64')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 05:22:12 | Medium | 1 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 05:20:15 | Medium | 1 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 05:13:32 | Medium | 1 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 19:54:21 | Medium | 1 |
| 2026-09-03 07:52:31 | Medium | 1 |
| 2026-09-03 05:52:26 | Medium | 1 |