ibus-misstype-git
LOW
maintainer pastleo
0 votes
scanned 2026-10-17 00:21:55.226236
Why flagged
The MISSTYPE_SOURCE_URL variable allows overriding the git source URL at build time, which is mildly suspicious but likely intended for local/CI builds; all other sources are from legitimate project repositories (GitHub, ziglang.org) with pinned commits and verified checksums, and no obfuscated payloads or exfiltration are present.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The MISSTYPE_SOURCE_URL variable allows overriding the git source URL at build time, which is mildly suspicious but likely intended for local/CI builds; all other sources are from legitimate project repositories (GitHub, ziglang.org) with pinned commits and verified checksums, and no obfuscated payloads or exfiltration are present.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:47
source_x86_64=("https://ziglang.org/download/$_zig_version/zig-x86_64-linux-$_zig_version.tar.xz")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: PastLeo <chgu82837@gmail.com>
2
# AUR packaging recipe for the IBus engine; see docs/arch-linux.md. Not
3
# published yet (the fcitx5 recipe in ../aur is). Release builds use it through
4
# script/linux/package_arch.sh <version> ibus.
5
pkgname=ibus-misstype-git
6
pkgver=0.1.r212.g5135a1f
7
pkgrel=1
8
pkgdesc='Offline, fuzzy Zhuyin input method for IBus'
9
arch=('x86_64' 'aarch64')
10
url='https://github.com/Yukaii/misstype'
11
license=('MIT' 'BSD-3-Clause' 'CC-BY-4.0' 'CC-BY-SA-4.0' 'Unicode-3.0')
12
# gtk4: the engine's <setup> tool (Preferences in ibus-setup) links it.
13
depends=('ibus' 'gtk4' 'gcc-libs' 'glibc')
14
makedepends=('git' 'cmake' 'ninja' 'python' 'gtk4')
15
provides=('ibus-misstype')
16
# Both packages ship libMisstypeCAPI.so, the lexicon and misstypectl.
17
conflicts=('ibus-misstype' 'fcitx5-misstype-git' 'fcitx5-misstype')
18
# Zig manages its own optimization and debug information.
19
options=('!lto' '!debug')
20
_mcbopomofo=f5ba010ce8795d283ee336ca7d16380f200bd2ec
21
_naer=889efe0da5e10f5eea5920027748e9dd1f58169a
22
_english=525f9b560de45753a5ea01069454e72e9aa541c6
23
source=("misstype::git+${MISSTYPE_SOURCE_URL:-$url.git}"
24
"BPMFBase.txt::https://raw.githubusercontent.com/openvanilla/McBopomofo/$_mcbopomofo/Source/Data/BPMFBase.txt"
25
"BPMFMappings.txt::https://raw.githubusercontent.com/openvanilla/McBopomofo/$_mcbopomofo/Source/Data/BPMFMappings.txt"
26
"phrase.occ::https://raw.githubusercontent.com/openvanilla/McBopomofo/$_mcbopomofo/Source/Data/phrase.occ"
27
"mcbopomofo-LICENSE.txt::https://raw.githubusercontent.com/openvanilla/McBopomofo/$_mcbopomofo/LICENSE.txt"
28
"mcbopomofo-README.md::https://raw.githubusercontent.com/openvanilla/McBopomofo/$_mcbopomofo/Source/Data/README.md"
29
"heterophony1.list::https://raw.githubusercontent.com/openvanilla/McBopomofo/$_mcbopomofo/Source/Data/heterophony1.list"
30
"heterophony2.list::https://raw.githubusercontent.com/openvanilla/McBopomofo/$_mcbopomofo/Source/Data/heterophony2.list"
31
"heterophony3.list::https://raw.githubusercontent.com/openvanilla/McBopomofo/$_mcbopomofo/Source/Data/heterophony3.list"
32
"frequency.tsv::https://raw.githubusercontent.com/chiakich/ChiaKey-Lexicon/$_naer/sources/naer-word-frequency/frequency.tsv"
33
"en_50k.txt::https://raw.githubusercontent.com/hermitdave/FrequencyWords/$_english/content/2018/en/en_50k.txt")
34
sha256sums=('SKIP'
35
'46e64a53dc9c6baa2cbe6e0b1af572f8ef6aafb50597178b5fd53df804316ce7'
36
'baa9452ef927b3268f600ca69fe27eb0838b8be31c8ae0dd8540561db68c7ffd'
37
'2dbe37c1c61266f65d158a3e0020a0c1f2a75039ebd7f1580ef8e537a7bc8779'
38
'72ed32193b0c629def66df63791b2fb125946b593a3251380e6b949488f47b72'
39
'4b2eea7122a2a4d8bea7f23f611c6817d681a55d397b1ba3f8100acbfeb9f82e'
40
'7fddbb6a66022b1809181484c7627d79dee4231849cb2d3c8c8cd4578b3d22cb'
41
'4afd69a2702ae3af533cd01b755f81d77a430ace91311a8229319334aec24e37'
42
'8be3f37fe419744c3792df1bdfc67a0abdb215dbbb759c92204d4f8d68a32cd9'
43
'd8bf3ebec541c3dde967d536e05a33a2b8d5e4c4aeea1205feb4f0867220169a'
44
'5351ff405b1126ef555791dd4d9798a48e3e9a501a9fc481a9da957752cfb458')
45
46
_zig_version=0.17.0
47
source_x86_64=("https://ziglang.org/download/$_zig_version/zig-x86_64-linux-$_zig_version.tar.xz")
48
sha256sums_x86_64=('1cbe9df9f27e6b78d14ccbca43b6703a404ef79ef1c463de901d7f088d4e2026')
49
source_aarch64=("https://ziglang.org/download/$_zig_version/zig-aarch64-linux-$_zig_version.tar.xz")
50
sha256sums_aarch64=('9e8d11661d4ae3bd57702a3832781e23ad151dde5798e16a5ccd503f65234ff8')
51
52
_zig() {
53
export MISSTYPE_ZIG="$srcdir/zig-$CARCH-linux-$_zig_version/zig"
54
}
55
56
pkgver() {
57
cd "$srcdir/misstype"
58
printf '0.1.r%s.g%s' "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
59
}
60
61
prepare() {
62
cd "$srcdir/misstype"
63
# Seed the upstream cache from makepkg's verified sources: no downloads
64
# during prepare/build/check. Upstream verifies the manifests again.
65
install -dm755 .cache/{mcbopomofo,naer,frequencywords}
66
install -m644 "$srcdir/"{BPMFBase.txt,BPMFMappings.txt,phrase.occ,heterophony{1,2,3}.list} .cache/mcbopomofo/
67
install -m644 "$srcdir/mcbopomofo-LICENSE.txt" .cache/mcbopomofo/LICENSE.txt
68
install -m644 "$srcdir/mcbopomofo-README.md" .cache/mcbopomofo/README.md
69
install -m644 "$srcdir/frequency.tsv" .cache/naer/
70
install -m644 "$srcdir/en_50k.txt" .cache/frequencywords/
71
python script/prepare_lexicon.py
72
}
73
74
build() {
75
cd "$srcdir/misstype"
76
_zig
77
# libMisstypeCAPI.so and misstypectl (settings/dictionary CLI).
78
bash script/linux/build_capi.sh
79
local capi_dir
80
capi_dir=$(cat build/capi/libdir)
81
cmake -S linux/ibus -B build/arch -G Ninja \
82
-DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=/usr \
83
-DCMAKE_INSTALL_LIBDIR=lib -DMISSTYPE_CAPI_DIR="$capi_dir"
84
cmake --build build/arch
85
}
86
87
check() {
88
cd "$srcdir/misstype"
89
_zig
90
(cd core-zig && "$MISSTYPE_ZIG" build test -Doptimize=ReleaseFast)
91
bash script/linux/test_capi.sh
92
# The headless IBus suite (script/linux/test_ibus.sh) needs Xvfb and a
93
# private session bus; CI runs it, so it is not repeated here.
94
}
95
96
package() {
97
cd "$srcdir/misstype"
98
DESTDIR="$pkgdir" cmake --install build/arch
99
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
100
install -Dm644 THIRD_PARTY_NOTICES.md "$pkgdir/usr/share/licenses/$pkgname/THIRD_PARTY_NOTICES.md"
101
cp -a third_party "$pkgdir/usr/share/licenses/$pkgname/"
102
}
103
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-17 00:21:55 | Low | 3 |
| 2026-10-16 00:12:47 | Low | 3 |
| 2026-10-15 00:28:05 | Low | 3 |
| 2026-10-14 00:06:47 | Low | 3 |
| 2026-10-13 00:23:45 | Low | 3 |
| 2026-10-12 00:18:51 | Low | 3 |
| 2026-10-11 11:14:09 | Low | 3 |
| 2026-10-11 11:10:32 | Medium | 2 |