iceshrimp-pre

LOW

maintainer zotan 1 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The source is a git-lfs checkout from the project's own domain (iceshrimp.dev), which is pl

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git-lfs checkout from the project's own domain (iceshrimp.dev), which is pl

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 "iceshrimp::git-lfs+https://iceshrimp.dev/iceshrimp/iceshrimp.git#tag=${_pkgver/.pre/-pre}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zotan <aur@zotan.email>
    
      2
    
      3pkgname=iceshrimp-pre
    
      4pkgver=v2026.5.2
    
      5pkgrel=1
    
      6pkgdesc="YAMF (Yet another Misskey fork) bringing you no-nonsense fixes, features & improvements you actually want since 2023"
    
      7arch=(x86_64 aarch64)
    
      8url="https://iceshrimp.dev/iceshrimp/iceshrimp"
    
      9license=(AGPL3)
    
      10
    
      11_pkgver=$(echo "$pkgver" | sed 's/\.0$//')
    
      12
    
      13makedepends=(makepkg-git-lfs-proto corepack npm)
    
      14depends=(nodejs-lts-krypton)
    
      15optdepends=(
    
      16  "ffmpeg: for video transcoding"
    
      17)
    
      18
    
      19conflicts=(iceshrimp)
    
      20provides=(iceshrimp)
    
      21
    
      22backup=("etc/iceshrimp/configuration.yml")
    
      23
    
      24install="iceshrimp.install"
    
      25
    
      26source=(
    
      27  "iceshrimp::git-lfs+https://iceshrimp.dev/iceshrimp/iceshrimp.git#tag=${_pkgver/.pre/-pre}"
    
      28  "iceshrimp.service"
    
      29  "iceshrimp.sysusers"
    
      30  "iceshrimp.tmpfiles"
    
      31  "iceshrimp.install"
    
      32  "iceshrimp.hook"
    
      33)
    
      34
    
      35sha512sums=('SKIP'
    
      36            '3b545a3c5a76d0ef1f4f3189ff7d8c61bc711ff3543d345c8bae2c6e10367dbd1302ef1890bc3d799403946ce65db20336752873334c6c106707e293821861fb'
    
      37            '9adf1781842ae7ff2779ca561f06ab2b6fb93e206698084283986627aba69b0fd4482ccbed3daebb2517e5966c326604e1cc57618589f331a966fee2db63815d'
    
      38            '124e932244a403733e20e63b1e1dbf59afc90e3bd8240c314c6ecd2c8ffe8c5fade5e20b6755de9e68a76e99eacbaafa42bfb367caa5f13638857a4147af8795'
    
      39            '36980c4f5a6d25d4f522ccd64aaf38c3d704c29a25b834b14135e2895f55318496fbaf269e589e4eabbf5495265682d6f58b966ce8b70f52190dccf7a18f44cc'
    
      40            '130d1b1aae460ddb082d945b525fb046dcaa9084622b6daebff3f1cd9c8d4cc7dc7b68959a5487cfc0df91641c5423dccc723152726980b7230c2134f7bf2a6a')
    
      41
    
      42build() {
    
      43  cd "${srcdir}/iceshrimp"
    
      44
    
      45  # Fix node-re2 build
    
      46  export CXXFLAGS="${CXXFLAGS/-fno-plt/}"
    
      47  export CXXFLAGS="${CXXFLAGS/-Wp,-D_GLIBCXX_ASSERTIONS/}"
    
      48  export LDFLAGS="${LDFLAGS/,-z,now/}"
    
      49
    
      50  export NODE_ENV="production"
    
      51
    
      52  corepack yarn install --immutable
    
      53  corepack yarn build
    
      54  corepack yarn focus-production
    
      55}
    
      56
    
      57package() {
    
      58  # Add runtime-only dependencies
    
      59  depends+=(redis postgresql)
    
      60
    
      61  install -dm 755 "${pkgdir}/usr/share/iceshrimp"
    
      62  install -dm 755 "${pkgdir}/etc/iceshrimp"
    
      63  install -Dm 644 "${srcdir}/iceshrimp/COPYING" "${pkgdir}/usr/share/licenses/${pkgname}/COPYING"
    
      64  install -Dm 644 "${srcdir}/iceshrimp.service" "${pkgdir}/usr/lib/systemd/system/iceshrimp.service"
    
      65  install -Dm 644 "${srcdir}/iceshrimp.sysusers" "${pkgdir}/usr/lib/sysusers.d/iceshrimp.conf"
    
      66  install -Dm 644 "${srcdir}/iceshrimp.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/iceshrimp.conf"
    
      67  install -Dm 644 "${srcdir}/iceshrimp.hook" "${pkgdir}/usr/share/libalpm/hooks/iceshrimp.hook"
    
      68  install -Dm 640 "${srcdir}/iceshrimp/.config/example.yml" "${pkgdir}/etc/iceshrimp/configuration.yml"
    
      69
    
      70  find "${srcdir}/iceshrimp/.yarn/unplugged" -path "*/re2/build/Makefile" -or -path "*/re2/build/config.gypi" | xargs -r sed -i "s%${srcdir}%/usr/share%g"
    
      71
    
      72  cp -dpTr --no-preserve=ownership "${srcdir}/iceshrimp/" "${pkgdir}/usr/share/iceshrimp"
    
      73
    
      74  rm -rf "${pkgdir}/usr/share/iceshrimp/.git"
    
      75}
    
      76

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-10-17 00:21
@@ -1,7 +1,7 @@
 # Maintainer: zotan <aur@zotan.email>
 
 pkgname=iceshrimp-pre
-pkgver=v2026.5.1
+pkgver=v2026.5.2
 pkgrel=1
 pkgdesc="YAMF (Yet another Misskey fork) bringing you no-nonsense fixes, features & improvements you actually want since 2023"
 arch=(x86_64 aarch64)

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 19:16:12	Medium	1
2026-06-19 19:07:35	Clean	2
2026-06-18 16:11:54	Medium	1