grabit-git

LOW

maintainer creations 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The source is a git repository hosted on a personal domain, but it is the project's own source code being built, which is normal for AUR packages; the non-whitelisted host is not inherently dangerous in this context.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The source is a git repository hosted on a personal domain, but it is the project's own source code being built, which is normal for AUR packages; the non-whitelisted host is not inherently dangerous in this context.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:36 source=("grabit::git+https://heliopolis.live/creations/grabit.git#branch=main")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: creations <creations@creations.works>
    
      2pkgname=grabit-git
    
      3pkgver=0.8.0.r346.g95f6f1d
    
      4pkgrel=1
    
      5pkgdesc="Screenshot, screen-recording, OCR, and uploader for wlroots and KDE Plasma 6 Wayland compositors (git)"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://heliopolis.live/creations/grabit"
    
      8license=('AGPL-3.0-or-later')
    
      9depends=(
    
      10    'cairo'
    
      11    'curl'
    
      12    'dbus'
    
      13    'file'
    
      14    'json-c'
    
      15    'libxkbcommon'
    
      16    'wayland'
    
      17)
    
      18makedepends=(
    
      19    'git'
    
      20    'wayland-protocols'
    
      21)
    
      22optdepends=(
    
      23    'ffmpeg: --record support'
    
      24    'tesseract: --tesseract (OCR) support'
    
      25    'tesseract-data-eng: english OCR data'
    
      26    'translate-shell: --translate (OCR -> translated text) support'
    
      27    'libjpeg-turbo: JPEG output (--format jpeg)'
    
      28    'libwebp: WebP output (--format webp)'
    
      29    'pipewire: pw-play (default shutter-sound player)'
    
      30    'libpulse: paplay (alternative sound player)'
    
      31    'alsa-utils: aplay (alternative sound player)'
    
      32    'sox: play (alternative sound player)'
    
      33)
    
      34provides=("grabit=${pkgver%%.r*}")
    
      35conflicts=('grabit' 'grabit-bin')
    
      36source=("grabit::git+https://heliopolis.live/creations/grabit.git#branch=main")
    
      37sha256sums=('SKIP')
    
      38
    
      39pkgver() {
    
      40    cd "${srcdir}/grabit"
    
      41    printf "%s.r%s.g%s" \
    
      42        "$(awk '/^VERSION/ {print $3; exit}' Makefile)" \
    
      43        "$(git rev-list --count HEAD)" \
    
      44        "$(git rev-parse --short HEAD)"
    
      45}
    
      46
    
      47build() {
    
      48    cd "${srcdir}/grabit"
    
      49    make all VERSION="${pkgver%.r*}"
    
      50}
    
      51
    
      52package() {
    
      53    cd "${srcdir}/grabit"
    
      54    make install DESTDIR="${pkgdir}" PREFIX="/usr"
    
      55    install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      56    install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      57    install -Dm644 OPTIONS.md "${pkgdir}/usr/share/doc/${pkgname}/OPTIONS.md"
    
      58    install -Dm644 PLUGINS.md "${pkgdir}/usr/share/doc/${pkgname}/PLUGINS.md"
    
      59}
    
      60

Changes since previous scan

--- PKGBUILD @ 2026-10-29 00:13
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,6 +1,6 @@
 # Maintainer: creations <creations@creations.works>
 pkgname=grabit-git
-pkgver=0.8.0.r345.g481ec5d
+pkgver=0.8.0.r346.g95f6f1d
 pkgrel=1
 pkgdesc="Screenshot, screen-recording, OCR, and uploader for wlroots and KDE Plasma 6 Wayland compositors (git)"
 arch=('x86_64' 'aarch64')

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 05:51:59	Medium	1
2026-10-29 00:13:55	Clean	2
2026-10-28 05:49:54	Medium	1
2026-10-17 00:21:55	Clean	2
2026-10-16 05:14:45	Medium	1
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 00:11:52	Low	2
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-05 23:40:58	Medium	1
2026-09-21 00:26:32	Clean	2