gtk2-ng-git

LOW

maintainer andreas_baumann 8 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is a Git repository from a plausible project-maintained host (git.devuan.org) used to build the project's own code, which is a normal and low-risk AUR practice despite the non-whitelisted domain.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a Git repository from a plausible project-maintained host (git.devuan.org) used to build the project's own code, which is a normal and low-risk AUR practice despite the non-whitelisted domain.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:43 "git+https://git.devuan.org/Daemonratte/gtk2-ng"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Andreas Baumann <mail@andreasbaumann.cc>
    
      2# Contributor: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
    
      3# Contributor: Jan de Groot <jgc@archlinux.org>
    
      4
    
      5pkgname=gtk2-ng-git
    
      6pkgver=r22068.0675b80da
    
      7pkgrel=4
    
      8pkgdesc="GObject-based multi-platform GUI toolkit (community-maintained fork)"
    
      9url="https://www.gtk.org/"
    
      10arch=('x86_64' 'aarch64')
    
      11license=(LGPL-2.1-or-later)
    
      12depends=(
    
      13  atk
    
      14  cairo
    
      15  desktop-file-utils
    
      16  fontconfig
    
      17  gdk-pixbuf2
    
      18  glib2
    
      19  glibc
    
      20  gtk-update-icon-cache
    
      21  libcups
    
      22  librsvg
    
      23  libx11
    
      24  libxcomposite
    
      25  libxcursor
    
      26  libxdamage
    
      27  libxext
    
      28  libxfixes
    
      29  libxi
    
      30  libxinerama
    
      31  libxrandr
    
      32  libxrender
    
      33  pango
    
      34  shared-mime-info
    
      35)
    
      36makedepends=(
    
      37  git
    
      38  glib2-devel
    
      39  gobject-introspection
    
      40  gtk-doc
    
      41)
    
      42source=(
    
      43  "git+https://git.devuan.org/Daemonratte/gtk2-ng"
    
      44  gtk-query-immodules-2.0.hook
    
      45)
    
      46b2sums=('SKIP'
    
      47        '9c531f9f605e1739e13c39c1cac22daddd9574f3082f18bcf0b9dfaa4c41f2485d55be03a9ed12fb4504d509f0d5ac63980a9d9349e3f80a06595c6430c78096')
    
      48provides=('gtk2' 'gtk2=2.24.33')
    
      49conflicts=('gtk2')
    
      50replaces=('gtk2')
    
      51
    
      52pkgver() {
    
      53  cd gtk2-ng
    
      54  ( set -o pipefail
    
      55    git describe --long 2>/dev/null | sed 's/\([^-]*-g\)/r\1/;s/-/./g' ||
    
      56    printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      57  )
    
      58}
    
      59
    
      60prepare() {
    
      61  cd gtk2-ng
    
      62  sed -i '/AM_INIT_AUTOMAKE/s/]/ foreign]/' configure.ac
    
      63  autoreconf -fvi
    
      64}
    
      65
    
      66build() {
    
      67  local configure_options=(
    
      68    --prefix=/usr
    
      69    --sysconfdir=/etc
    
      70    --localstatedir=/var
    
      71    --with-xinput=yes
    
      72    --disable-gtk-doc
    
      73  )
    
      74
    
      75  CFLAGS+=" -Wno-error=implicit-int -Wno-error=incompatible-pointer-types"
    
      76
    
      77  cd gtk2-ng
    
      78  ./configure "${configure_options[@]}"
    
      79  sed -i -e 's/ -shared / -Wl,-O1,--as-needed\0/g' libtool
    
      80  make
    
      81}
    
      82
    
      83package() {
    
      84  optdepends=(
    
      85    'adwaita-fonts: Default font'
    
      86    'adwaita-icon-theme: Default icon theme'
    
      87    'gnome-themes-extra-gtk2: Default widget theme'
    
      88    'python: gtk-builder-convert'
    
      89  )
    
      90  provides+=(
    
      91    libgailutil.so
    
      92    libgdk-x11-2.0.so
    
      93    libgtk-x11-2.0.so
    
      94  )
    
      95  install=gtk2.install
    
      96
    
      97  make -C gtk2-ng DESTDIR="$pkgdir" install
    
      98
    
      99  install -Dm644 /dev/stdin "$pkgdir/usr/share/gtk-2.0/gtkrc" <<END
    
      100gtk-icon-theme-name = "Adwaita"
    
      101gtk-theme-name = "Adwaita"
    
      102gtk-font-name = "Adwaita Sans 11"
    
      103END
    
      104
    
      105  install -Dm644 gtk-query-immodules-2.0.hook -t "$pkgdir/usr/share/libalpm/hooks"
    
      106
    
      107  # Built by GTK 4, shared with GTK 2/3
    
      108  rm "$pkgdir/usr/bin/gtk-update-icon-cache"
    
      109}
    
      110
    
      111# vim:set sw=2 sts=-1 et:
    
      112

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2