inkycap-git

LOW

maintainer jy0x0 0 votes scanned 2026-09-24 13:45:49.383719

View on AUR

Why flagged

Source is cloned from a non-standard self-hosted git forge (codefloe.com) that appears to be the project's own infrastructure, builds from source using cargo/npm, and notably replaces a prebuilt sidecar binary with the system tinymist package rather than downloading it; the main risks are the unverified host and SKIP'd checksum, but there is no obfuscated payload, no exfiltration, and no prebuilt executable from an unrelated swappable host.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Source is cloned from a non-standard self-hosted git forge (codefloe.com) that appears to be the project's own infrastructure, builds from source using cargo/npm, and notably replaces a prebuilt sidecar binary with the system tinymist package rather than downloading it; the main risks are the unverified host and SKIP'd checksum, but there is no obfuscated payload, no exfiltration, and no prebuilt executable from an unrelated swappable host.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:41 source=('git+https://codefloe.com/InkyCap/app.git')

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Junyi Xu <junyixu0@gmail.com>
    
      2
    
      3pkgname=inkycap-git
    
      4_pkgname=inkycap
    
      5_appname=InkyCap
    
      6pkgver=26.9.14.r0.g1d18307
    
      7pkgrel=1
    
      8pkgdesc='Typst-based personal knowledge management app with linked notes for writing and academic research'
    
      9arch=('x86_64' 'aarch64')
    
      10url='https://inkycap.org'
    
      11license=('LiLiQ-P-1.1')
    
      12depends=(
    
      13  'bzip2'
    
      14  'cairo'
    
      15  'dbus'
    
      16  'gdk-pixbuf2'
    
      17  'glib2'
    
      18  'glibc'
    
      19  'gst-libav'
    
      20  'gst-plugins-bad'
    
      21  'gst-plugins-base'
    
      22  'gst-plugins-good'
    
      23  'gtk3'
    
      24  'hicolor-icon-theme'
    
      25  'libgcc'
    
      26  'libsoup3'
    
      27  'tinymist'
    
      28  'webkit2gtk-4.1'
    
      29  'xz'
    
      30  'zlib'
    
      31)
    
      32makedepends=(
    
      33  'cargo'
    
      34  'git'
    
      35  'nodejs'
    
      36  'npm'
    
      37)
    
      38provides=("$_pkgname")
    
      39conflicts=("$_pkgname")
    
      40options=('!lto')
    
      41source=('git+https://codefloe.com/InkyCap/app.git')
    
      42sha256sums=('SKIP')
    
      43
    
      44pkgver() {
    
      45  cd app
    
      46  git describe --long --tags --abbrev=7 | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      47}
    
      48
    
      49prepare() {
    
      50  cd app
    
      51
    
      52  export npm_config_cache="$srcdir/npm-cache"
    
      53  npm ci --no-audit --no-fund
    
      54
    
      55  export RUSTUP_TOOLCHAIN=stable
    
      56  cd src-tauri
    
      57  cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      58
    
      59  # Tauri requires the externalBin sidecar at build time; use Arch's tinymist
    
      60  # instead of the prebuilt binary upstream downloads from GitHub.
    
      61  mkdir -p binaries
    
      62  ln -sf /usr/bin/tinymist "binaries/inkycap-tinymist-$(rustc -vV | sed -n 's/host: //p')"
    
      63}
    
      64
    
      65build() {
    
      66  cd app
    
      67
    
      68  export npm_config_cache="$srcdir/npm-cache"
    
      69  export RUSTUP_TOOLCHAIN=stable
    
      70  # --no-bundle builds only the binary; without a bundle type the app also
    
      71  # disables its self-upgrade feature, leaving updates to pacman.
    
      72  npm exec -- tauri build --no-bundle -- --frozen
    
      73}
    
      74
    
      75package() {
    
      76  cd app
    
      77
    
      78  install -Dm755 src-tauri/target/release/$_pkgname "$pkgdir/usr/bin/$_pkgname"
    
      79  # Command.sidecar() resolves the sidecar next to the main executable.
    
      80  ln -s tinymist "$pkgdir/usr/bin/$_pkgname-tinymist"
    
      81
    
      82  # Tauri's resource_dir() on Linux is /usr/lib/<productName>.
    
      83  install -Dm644 -t "$pkgdir/usr/lib/$_appname/licenses" src-tauri/licenses/*
    
      84
    
      85  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/$_pkgname.desktop" <<EOF
    
      86[Desktop Entry]
    
      87Categories=Office;
    
      88Comment=Typst-based PKM with linked-notes for writing and academic research
    
      89Comment[fr]=PKM basé sur Typst, avec notes liées, pour l'écriture et la recherche académiques
    
      90Exec=$_pkgname
    
      91StartupWMClass=$_pkgname
    
      92Icon=$_pkgname
    
      93Name=$_appname
    
      94Terminal=false
    
      95Type=Application
    
      96EOF
    
      97
    
      98  install -Dm644 src-tauri/icons/32x32.png "$pkgdir/usr/share/icons/hicolor/32x32/apps/$_pkgname.png"
    
      99  install -Dm644 src-tauri/icons/64x64.png "$pkgdir/usr/share/icons/hicolor/64x64/apps/$_pkgname.png"
    
      100  install -Dm644 src-tauri/icons/128x128.png "$pkgdir/usr/share/icons/hicolor/128x128/apps/$_pkgname.png"
    
      101  install -Dm644 src-tauri/icons/128x128@2x.png "$pkgdir/usr/share/icons/hicolor/256x256/apps/$_pkgname.png"
    
      102  install -Dm644 src-tauri/icons/icon.png "$pkgdir/usr/share/icons/hicolor/512x512/apps/$_pkgname.png"
    
      103  install -Dm644 src-tauri/icons/icon.svg "$pkgdir/usr/share/icons/hicolor/scalable/apps/$_pkgname.svg"
    
      104
    
      105  install -Dm644 -t "$pkgdir/usr/share/licenses/$pkgname" LICENSE LICENSE.fr
    
      106}
    
      107

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-24 13:45:49	Low	3
2026-09-24 13:43:45	Medium	2