judoshiai

LOW
maintainer FinleyLaempe 0 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The package builds from a legitimate project source on SourceForge and downloads prebuilt web assets from the project's official release channel; the non-whitelisted host is the project's own, so the risk is low despite the static analyzer flag.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a legitimate project source on SourceForge and downloads prebuilt web assets from the project's official release channel; the non-whitelisted host is the project's own, so the risk is low despite the static analyzer flag.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:20 source=("judoshiai-src::git+https://git.code.sf.net/p/judoshiai/judoshiai")

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: FinleyLaempe <finley.laempe@web.de>
2pkgname=judoshiai
3pkgver=4.4.1
4pkgrel=1
5pkgdesc="A set of programs to help organize a judo tournament (latest stable release)"
6arch=('x86_64')
7url="https://www.judoshiai.org"
8license=('custom')
9depends=(
10 'libao' 'cairo' 'curl' 'gdk-pixbuf2' 'gtk3' 'pango' 'librsvg'
11 'libssh2' 'libuv' 'gnutls' 'mpg123' 'libxml2-legacy' 'lua' 'libcap'
12 'p11-kit' 'openssl'
13)
14makedepends=('git' 'cmake' 'bison' 'flex' 'pkgconf' 'gcc' 'make' 'gettext'
15 'curl' 'libarchive')
16provides=('judotimer' 'judoinfo' 'judoweight' 'judojudogi')
17conflicts=('judoshiai-git')
18# VCS source: AUR helpers run with --devel will re-fetch and rebuild, picking
19# up any newly published stable tag automatically (see prepare/pkgver).
20source=("judoshiai-src::git+https://git.code.sf.net/p/judoshiai/judoshiai")
21sha256sums=('SKIP')
22
23# Newest stable tag = highest `version-X[.Y[.Z]]` (pre-release suffixes like
24# `4.0a` or `2.4beta10` are excluded by the numeric-only regex).
25_latest_stable_tag() {
26 git -C "$srcdir/judoshiai-src" tag -l 'version-*' \
27 | grep -E '^version-[0-9]+(\.[0-9]+)*$' \
28 | sort -V | tail -1
29}
30
31pkgver() {
32 cd "$srcdir/judoshiai-src"
33 git describe --tags --abbrev=0 | sed 's/^version-//'
34}
35
36prepare() {
37 cd "$srcdir/judoshiai-src"
38
39 # Track the newest stable tag automatically. Runs before pkgver(), so the
40 # reported version always matches the checked-out tag.
41 local tag
42 tag=$(_latest_stable_tag)
43 [[ -n $tag ]] || { echo "no stable tag found" >&2; return 1; }
44 msg2 "Building stable tag: $tag"
45 git checkout -f "$tag"
46
47 # Lua: code expects /usr/include/lua5.4 + -llua5.4. Arch ships plain lua.
48 mkdir -p "$srcdir/lua-shim/include/lua5.4" "$srcdir/lua-shim/lib"
49 for h in lua.h lualib.h lauxlib.h luaconf.h; do
50 ln -sf "/usr/include/$h" "$srcdir/lua-shim/include/lua5.4/$h"
51 done
52 ln -sf /usr/lib/liblua.so "$srcdir/lua-shim/lib/liblua5.4.so"
53
54 # gcc >=15 default C23: bool/true/false are reserved. 3rdparty/QRCode
55 # still does `typedef unsigned char bool; static const bool false=0;`.
56 # Replace with <stdbool.h>.
57 sed -i \
58 -e 's|^typedef unsigned char bool;$|#include <stdbool.h>|' \
59 -e '/^static const bool false = 0;$/d' \
60 -e '/^static const bool true = 1;$/d' \
61 3rdparty/QRCode/src/qrcode.h
62
63 # cmake >=4 dropped policy compat <3.5. Vendored libwebsockets needs bump.
64 sed -i 's|cmake_minimum_required *(VERSION [0-9.]*)|cmake_minimum_required(VERSION 3.5)|I' \
65 3rdparty/libwebsockets/CMakeLists.txt
66
67 # basic.tab.o (yacc/bison output) uses exp() → need -lm. Upstream Makefile
68 # omits it on Linux. Append to LIBS line that ends with `-lssh2 -ldl`.
69 sed -i 's/-lssh2 -ldl$/-lssh2 -ldl -lm/' mk/linux.mk
70}
71
72build() {
73 cd "$srcdir/judoshiai-src"
74 # mk/linux.mk uses `JS_BUILD_DIR=/home/$USER/js-build` (hard assignment),
75 # so we must pass it as a make argument to override.
76 local -a mk=(JS_BUILD_DIR="$srcdir/js-build")
77 # gcc >=15 defaults to C23 where bool/true/false are keywords; 3rdparty
78 # qrcode.h still does `typedef unsigned char bool;`. Force gnu17.
79 export CFLAGS="${CFLAGS} -std=gnu17 -I$srcdir/lua-shim/include -Wno-deprecated-declarations"
80 export LDFLAGS="${LDFLAGS} -L$srcdir/lua-shim/lib"
81
82 # Build the subdirs we actually ship. Skip flutter, doc (libreoffice),
83 # judoproxy, judohttpd, auto-update; the root Makefile's `all` target
84 # also runs broken cp-from-$RUNDIR steps and we don't need them.
85 make "${mk[@]}" -C common locale
86 make "${mk[@]}" -C judoshiai
87 make "${mk[@]}" -C judotimer
88 make "${mk[@]}" -C judoinfo
89 make "${mk[@]}" -C judoweight
90 make "${mk[@]}" -C judojudogi
91 make "${mk[@]}" -C utils
92
93 # Web UI (browser scoreboard/referee/weigh-in) = Flutter web apps the app's
94 # embedded HTTP server serves from etc/web. Building them needs the Flutter
95 # SDK, so for stable releases we instead pull the prebuilt etc/web tree from
96 # upstream's matching official .deb. Version derives from $pkgver (the tag),
97 # so this follows new releases automatically with no hardcoding.
98 local deb="$srcdir/judoshiai-upstream.deb"
99 local url="https://downloads.sourceforge.net/project/judoshiai/Linux-x86_64/judoshiai_${pkgver}-1_amd64.deb"
100 msg2 "Fetching prebuilt web assets from upstream .deb ($pkgver)"
101 curl -fL --retry 3 -o "$deb" "$url" || {
102 error "No upstream .deb for $pkgver yet (web assets unavailable)."
103 return 1
104 }
105 rm -rf "$srcdir/deb-extract"
106 mkdir -p "$srcdir/deb-extract"
107 bsdtar -xf "$deb" -C "$srcdir/deb-extract"
108 bsdtar -xf "$srcdir/deb-extract"/data.tar.* -C "$srcdir/deb-extract" \
109 ./usr/lib/judoshiai/etc/web
110 [[ -f "$srcdir/deb-extract/usr/lib/judoshiai/etc/web/shiai/index.html" ]] || {
111 error "etc/web not found in upstream .deb"
112 return 1
113 }
114}
115
116package() {
117 cd "$srcdir/judoshiai-src"
118 local obj="obj-linux"
119 local libdir="$pkgdir/usr/lib/judoshiai"
120
121 # Binaries land in /usr/lib/judoshiai/bin (rpath = 'bin' relative)
122 install -dm755 "$libdir/bin"
123 install -m755 "$srcdir/js-build/judoshiai/$obj/judoshiai" "$libdir/bin/"
124 install -m755 "$srcdir/js-build/judotimer/$obj/judotimer" "$libdir/bin/"
125 install -m755 "$srcdir/js-build/judoinfo/$obj/judoinfo" "$libdir/bin/"
126 install -m755 "$srcdir/js-build/judoweight/$obj/judoweight" "$libdir/bin/"
127 install -m755 "$srcdir/js-build/judojudogi/$obj/judojudogi" "$libdir/bin/"
128 install -m755 "$srcdir/js-build/utils/$obj/db-convert" "$libdir/bin/"
129
130 # Resource trees
131 cp -a etc "$libdir/"
132 # Prebuilt Flutter web UI (from upstream .deb, fetched in build()). httpd.c
133 # serves browser requests for /web/* from installation_dir/etc/web.
134 cp -a "$srcdir/deb-extract/usr/lib/judoshiai/etc/web" "$libdir/etc/"
135 cp -a svg "$libdir/"
136 cp -a svg-lisp "$libdir/"
137 cp -a svg-lua "$libdir/"
138 cp -a custom-examples "$libdir/"
139 cp -a share "$libdir/" 2>/dev/null || true
140
141 # Translations (.mo built by common/Makefile locale target)
142 declare -A langs=(
143 [fi]=fi_FI [sv]=sv_SE [es]=es_ES [et]=et_EE [uk]=uk_UA [is]=is_IS
144 [nb]=nb_NO [pl]=pl_PL [sk]=sk_SK [nl]=nl_NL [cs]=cs_CZ [de]=de_DE
145 [da]=da_DK [he]=he_IL [fr]=fr_FR [fa]=fa_IR [en_CA]=en_CA
146 [fr_CA]=fr_CA [en_US]=en_US [it]=it_IT
147 )
148 for dir in "${!langs[@]}"; do
149 local src="common/judoshiai-${langs[$dir]}.mo"
150 [[ -f $src ]] || continue
151 install -Dm644 "$src" "$pkgdir/usr/share/locale/$dir/LC_MESSAGES/judoshiai.mo"
152 done
153
154 # /usr/bin launchers
155 install -dm755 "$pkgdir/usr/bin"
156 for b in judoshiai judotimer judoinfo judoweight judojudogi; do
157 ln -sf "/usr/lib/judoshiai/bin/$b" "$pkgdir/usr/bin/$b"
158 done
159
160 # Desktop + icons + mime
161 install -dm755 "$pkgdir/usr/share/applications" \
162 "$pkgdir/usr/share/pixmaps" \
163 "$pkgdir/usr/share/icons/hicolor/48x48/apps" \
164 "$pkgdir/usr/share/mime/packages"
165 for d in judoshiai judotimer judoinfo judoweight judojudogi; do
166 install -m644 "gnome/$d.desktop" "$pkgdir/usr/share/applications/"
167 install -m644 "etc/png/$d.png" "$pkgdir/usr/share/pixmaps/"
168 install -m644 "etc/png/$d.png" "$pkgdir/usr/share/icons/hicolor/48x48/apps/"
169 done
170 install -m644 gnome/judoshiai.xml "$pkgdir/usr/share/mime/packages/"
171
172 # Licenses
173 install -dm755 "$pkgdir/usr/share/licenses/$pkgname"
174 install -m644 licenses/COPYING "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
175 cp -a licenses/* "$libdir/" 2>/dev/null || true
176
177 # lua5.4 runtime soname alias (binary linked against liblua5.4.so.0)
178 install -dm755 "$pkgdir/usr/lib"
179 ln -sf /usr/lib/liblua.so "$pkgdir/usr/lib/liblua5.4.so.0"
180}
181

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion