gyp-git

LOW

maintainer robertfoster 101 votes scanned 2026-10-31 19:58:49.989948

View on AUR

Why flagged

The source is a Git clone from the official project's own repository (chromium.googlesource.com), which is a legitimate and expected source for a -git AUR package, despite the host not being on a standard whitelist; the package builds from official project source, posing minimal risk.

Triggered rules

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The source is a Git clone from the official project's own repository (chromium.googlesource.com), which is a legitimate and expected source for a -git AUR package, despite the host not being on a standard whitelist; the package builds from official project source, posing minimal risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("gyp::git+https://chromium.googlesource.com/external/gyp")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: robertfoster
    
      2
    
      3pkgname=gyp-git
    
      4pkgver=2174.1615ec32
    
      5pkgrel=1
    
      6pkgdesc="GYP can Generate Your Projects."
    
      7url="https://chromium.googlesource.com/external/gyp"
    
      8arch=('x86_64')
    
      9makedepends=('git')
    
      10depends=('python' 'python-setuptools')
    
      11license=('custom')
    
      12source=("gyp::git+https://chromium.googlesource.com/external/gyp")
    
      13conflicts=('gyp-svn' "${pkgname%-git}")
    
      14replaces=('gyp-svn')
    
      15provides=("${pkgname%-git}")
    
      16
    
      17pkgver() {
    
      18  cd gyp
    
      19  echo "$(git rev-list --count master).$(git rev-parse --short master)"
    
      20}
    
      21
    
      22package() {
    
      23  cd gyp
    
      24  python3 setup.py install --root="$pkgdir"
    
      25}
    
      26
    
      27sha256sums=('SKIP')
    
      28

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-10-31 19:58
@@ -4,14 +4,15 @@
 pkgver=2174.1615ec32
 pkgrel=1
 pkgdesc="GYP can Generate Your Projects."
-url="http://code.google.com/p/gyp/"
-arch=('i686' 'x86_64')
+url="https://chromium.googlesource.com/external/gyp"
+arch=('x86_64')
 makedepends=('git')
 depends=('python' 'python-setuptools')
 license=('custom')
 source=("gyp::git+https://chromium.googlesource.com/external/gyp")
-conflicts=('gyp-svn')
+conflicts=('gyp-svn' "${pkgname%-git}")
 replaces=('gyp-svn')
+provides=("${pkgname%-git}")
 
 pkgver() {
   cd gyp

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-31 19:58:49	Low	2
2026-06-19 19:07:35	Clean	2
2026-06-18 16:11:54	Low	1