iceshrimp

LOW

maintainer zotan 1 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The source is a Git repository from the project's own domain (iceshrimp.dev), which is normal for AUR packages; building from a non-whitelisted but project-owned host is low risk, especially with versioned tag checkout and no execution of unverified prebuilt binaries.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a Git repository from the project's own domain (iceshrimp.dev), which is normal for AUR packages; building from a non-whitelisted but project-owned host is low risk, especially with versioned tag checkout and no execution of unverified prebuilt binaries.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 "iceshrimp::git-lfs+https://iceshrimp.dev/iceshrimp/iceshrimp.git#tag=${pkgver}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zotan <aur@zotan.email>
    
      2
    
      3pkgname=iceshrimp
    
      4pkgver=v2026.5.2
    
      5pkgrel=1
    
      6pkgdesc="YAMF (Yet another Misskey fork) bringing you no-nonsense fixes, features & improvements you actually want since 2023"
    
      7arch=(x86_64 aarch64)
    
      8url="https://iceshrimp.dev/iceshrimp/iceshrimp"
    
      9license=(AGPL3)
    
      10
    
      11makedepends=(makepkg-git-lfs-proto corepack npm)
    
      12depends=(nodejs-lts-krypton)
    
      13optdepends=(
    
      14  "ffmpeg: for video transcoding"
    
      15)
    
      16
    
      17backup=("etc/iceshrimp/configuration.yml")
    
      18
    
      19install="iceshrimp.install"
    
      20
    
      21source=(
    
      22  "iceshrimp::git-lfs+https://iceshrimp.dev/iceshrimp/iceshrimp.git#tag=${pkgver}"
    
      23  "iceshrimp.service"
    
      24  "iceshrimp.sysusers"
    
      25  "iceshrimp.tmpfiles"
    
      26  "iceshrimp.install"
    
      27  "iceshrimp.hook"
    
      28)
    
      29
    
      30sha512sums=('SKIP'
    
      31            '3b545a3c5a76d0ef1f4f3189ff7d8c61bc711ff3543d345c8bae2c6e10367dbd1302ef1890bc3d799403946ce65db20336752873334c6c106707e293821861fb'
    
      32            '9adf1781842ae7ff2779ca561f06ab2b6fb93e206698084283986627aba69b0fd4482ccbed3daebb2517e5966c326604e1cc57618589f331a966fee2db63815d'
    
      33            '124e932244a403733e20e63b1e1dbf59afc90e3bd8240c314c6ecd2c8ffe8c5fade5e20b6755de9e68a76e99eacbaafa42bfb367caa5f13638857a4147af8795'
    
      34            '36980c4f5a6d25d4f522ccd64aaf38c3d704c29a25b834b14135e2895f55318496fbaf269e589e4eabbf5495265682d6f58b966ce8b70f52190dccf7a18f44cc'
    
      35            'bd2df81ccc8fd5779c8e3432897c4e30edb5f7b1ebfcc87fd9191026caac4a4cd5a150cd42d532b38fbeeaa99fc953b7f537b699e4290503a50a9df5f97f388b')
    
      36
    
      37build() {
    
      38  cd "${srcdir}/iceshrimp"
    
      39
    
      40  # Fix node-re2 build
    
      41  export CXXFLAGS="${CXXFLAGS/-fno-plt/}"
    
      42  export CXXFLAGS="${CXXFLAGS/-Wp,-D_GLIBCXX_ASSERTIONS/}"
    
      43  export LDFLAGS="${LDFLAGS/,-z,now/}"
    
      44
    
      45  export NODE_ENV="production"
    
      46
    
      47  corepack yarn install --immutable
    
      48  corepack yarn build
    
      49  corepack yarn focus-production
    
      50}
    
      51
    
      52package() {
    
      53  # Add runtime-only dependencies
    
      54  depends+=(redis postgresql)
    
      55
    
      56  install -dm 755 "${pkgdir}/usr/share/iceshrimp"
    
      57  install -dm 755 "${pkgdir}/etc/iceshrimp"
    
      58  install -Dm 644 "${srcdir}/iceshrimp/COPYING" "${pkgdir}/usr/share/licenses/${pkgname}/COPYING"
    
      59  install -Dm 644 "${srcdir}/iceshrimp.service" "${pkgdir}/usr/lib/systemd/system/iceshrimp.service"
    
      60  install -Dm 644 "${srcdir}/iceshrimp.sysusers" "${pkgdir}/usr/lib/sysusers.d/iceshrimp.conf"
    
      61  install -Dm 644 "${srcdir}/iceshrimp.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/iceshrimp.conf"
    
      62  install -Dm 644 "${srcdir}/iceshrimp.hook" "${pkgdir}/usr/share/libalpm/hooks/iceshrimp.hook"
    
      63  install -Dm 640 "${srcdir}/iceshrimp/.config/example.yml" "${pkgdir}/etc/iceshrimp/configuration.yml"
    
      64
    
      65  find "${srcdir}/iceshrimp/.yarn/unplugged" -path "*/re2/build/Makefile" -or -path "*/re2/build/config.gypi" | xargs -r sed -i "s%${srcdir}%/usr/share%g"
    
      66
    
      67  cp -dpTr --no-preserve=ownership "${srcdir}/iceshrimp/" "${pkgdir}/usr/share/iceshrimp"
    
      68
    
      69  rm -rf "${pkgdir}/usr/share/iceshrimp/.git"
    
      70}
    
      71

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-10-17 00:21
@@ -1,7 +1,7 @@
 # Maintainer: zotan <aur@zotan.email>
 
 pkgname=iceshrimp
-pkgver=v2026.5.1
+pkgver=v2026.5.2
 pkgrel=1
 pkgdesc="YAMF (Yet another Misskey fork) bringing you no-nonsense fixes, features & improvements you actually want since 2023"
 arch=(x86_64 aarch64)

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 19:16:12	Medium	1
2026-06-19 19:07:35	Clean	2
2026-06-18 16:11:54	Medium	1