judoshiai

maintainer FinleyLaempe · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a legitimate project source on SourceForge and downloads prebuilt web assets from the project's official release channel; the non-whitelisted host is the project's own, so the risk is low despite the static analyzer flag.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a legitimate project source on SourceForge and downloads prebuilt web assets from the project's official release channel; the non-whitelisted host is the project's own, so the risk is low despite the static analyzer flag.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("judoshiai-src::git+https://git.code.sf.net/p/judoshiai/judoshiai")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: FinleyLaempe <finley.laempe@web.de>
    
      2pkgname=judoshiai
    
      3pkgver=4.4.1
    
      4pkgrel=1
    
      5pkgdesc="A set of programs to help organize a judo tournament (latest stable release)"
    
      6arch=('x86_64')
    
      7url="https://www.judoshiai.org"
    
      8license=('custom')
    
      9depends=(
    
  'libao' 'cairo' 'curl' 'gdk-pixbuf2' 'gtk3' 'pango' 'librsvg'
    
  'libssh2' 'libuv' 'gnutls' 'mpg123' 'libxml2-legacy' 'lua' 'libcap'
    
  'p11-kit' 'openssl'
    
      13)
    
      14makedepends=('git' 'cmake' 'bison' 'flex' 'pkgconf' 'gcc' 'make' 'gettext'
    
           'curl' 'libarchive')
    
      16provides=('judotimer' 'judoinfo' 'judoweight' 'judojudogi')
    
      17conflicts=('judoshiai-git')
    
      18# VCS source: AUR helpers run with --devel will re-fetch and rebuild, picking
    
      19# up any newly published stable tag automatically (see prepare/pkgver).
    
      20source=("judoshiai-src::git+https://git.code.sf.net/p/judoshiai/judoshiai")
    
      21sha256sums=('SKIP')
    
      22
    
      23# Newest stable tag = highest `version-X[.Y[.Z]]` (pre-release suffixes like
    
      24# `4.0a` or `2.4beta10` are excluded by the numeric-only regex).
    
      25_latest_stable_tag() {
    
  git -C "$srcdir/judoshiai-src" tag -l 'version-*' \
    
      | grep -E '^version-[0-9]+(\.[0-9]+)*$' \
    
      | sort -V | tail -1
    
      29}
    
      30
    
      31pkgver() {
    
  cd "$srcdir/judoshiai-src"
    
  git describe --tags --abbrev=0 | sed 's/^version-//'
    
      34}
    
      35
    
      36prepare() {
    
  cd "$srcdir/judoshiai-src"
    
      38
    
  # Track the newest stable tag automatically. Runs before pkgver(), so the
    
  # reported version always matches the checked-out tag.
    
  local tag
    
  tag=$(_latest_stable_tag)
    
  [[ -n $tag ]] || { echo "no stable tag found" >&2; return 1; }
    
  msg2 "Building stable tag: $tag"
    
  git checkout -f "$tag"
    
      46
    
  # Lua: code expects /usr/include/lua5.4 + -llua5.4. Arch ships plain lua.
    
  mkdir -p "$srcdir/lua-shim/include/lua5.4" "$srcdir/lua-shim/lib"
    
  for h in lua.h lualib.h lauxlib.h luaconf.h; do
    
      ln -sf "/usr/include/$h" "$srcdir/lua-shim/include/lua5.4/$h"
    
  done
    
  ln -sf /usr/lib/liblua.so "$srcdir/lua-shim/lib/liblua5.4.so"
    
      53
    
  # gcc >=15 default C23: bool/true/false are reserved. 3rdparty/QRCode
    
  # still does `typedef unsigned char bool; static const bool false=0;`.
    
  # Replace with <stdbool.h>.
    
  sed -i \
    
      -e 's|^typedef unsigned char bool;$|#include <stdbool.h>|' \
    
      -e '/^static const bool false = 0;$/d' \
    
      -e '/^static const bool true = 1;$/d' \
    
      3rdparty/QRCode/src/qrcode.h
    
      62
    
  # cmake >=4 dropped policy compat <3.5. Vendored libwebsockets needs bump.
    
  sed -i 's|cmake_minimum_required *(VERSION [0-9.]*)|cmake_minimum_required(VERSION 3.5)|I' \
    
      3rdparty/libwebsockets/CMakeLists.txt
    
      66
    
  # basic.tab.o (yacc/bison output) uses exp() → need -lm. Upstream Makefile
    
  # omits it on Linux. Append to LIBS line that ends with `-lssh2 -ldl`.
    
  sed -i 's/-lssh2 -ldl$/-lssh2 -ldl -lm/' mk/linux.mk
    
      70}
    
      71
    
      72build() {
    
  cd "$srcdir/judoshiai-src"
    
  # mk/linux.mk uses `JS_BUILD_DIR=/home/$USER/js-build` (hard assignment),
    
  # so we must pass it as a make argument to override.
    
  local -a mk=(JS_BUILD_DIR="$srcdir/js-build")
    
  # gcc >=15 defaults to C23 where bool/true/false are keywords; 3rdparty
    
  # qrcode.h still does `typedef unsigned char bool;`. Force gnu17.
    
  export CFLAGS="${CFLAGS} -std=gnu17 -I$srcdir/lua-shim/include -Wno-deprecated-declarations"
    
  export LDFLAGS="${LDFLAGS} -L$srcdir/lua-shim/lib"
    
      81
    
  # Build the subdirs we actually ship. Skip flutter, doc (libreoffice),
    
  # judoproxy, judohttpd, auto-update; the root Makefile's `all` target
    
  # also runs broken cp-from-$RUNDIR steps and we don't need them.
    
  make "${mk[@]}" -C common locale
    
  make "${mk[@]}" -C judoshiai
    
  make "${mk[@]}" -C judotimer
    
  make "${mk[@]}" -C judoinfo
    
  make "${mk[@]}" -C judoweight
    
  make "${mk[@]}" -C judojudogi
    
  make "${mk[@]}" -C utils
    
      92
    
  # Web UI (browser scoreboard/referee/weigh-in) = Flutter web apps the app's
    
  # embedded HTTP server serves from etc/web. Building them needs the Flutter
    
  # SDK, so for stable releases we instead pull the prebuilt etc/web tree from
    
  # upstream's matching official .deb. Version derives from $pkgver (the tag),
    
  # so this follows new releases automatically with no hardcoding.
    
  local deb="$srcdir/judoshiai-upstream.deb"
    
  local url="https://downloads.sourceforge.net/project/judoshiai/Linux-x86_64/judoshiai_${pkgver}-1_amd64.deb"
    
  msg2 "Fetching prebuilt web assets from upstream .deb ($pkgver)"
    
  curl -fL --retry 3 -o "$deb" "$url" || {
    
      error "No upstream .deb for $pkgver yet (web assets unavailable)."
    
      return 1
    
  }
    
  rm -rf "$srcdir/deb-extract"
    
  mkdir -p "$srcdir/deb-extract"
    
  bsdtar -xf "$deb" -C "$srcdir/deb-extract"
    
  bsdtar -xf "$srcdir/deb-extract"/data.tar.* -C "$srcdir/deb-extract" \
    
      ./usr/lib/judoshiai/etc/web
    
  [[ -f "$srcdir/deb-extract/usr/lib/judoshiai/etc/web/shiai/index.html" ]] || {
    
      error "etc/web not found in upstream .deb"
    
      return 1
    
  }
    
      114}
    
      115
    
      116package() {
    
  cd "$srcdir/judoshiai-src"
    
  local obj="obj-linux"
    
  local libdir="$pkgdir/usr/lib/judoshiai"
    
      120
    
  # Binaries land in /usr/lib/judoshiai/bin (rpath = 'bin' relative)
    
  install -dm755 "$libdir/bin"
    
  install -m755 "$srcdir/js-build/judoshiai/$obj/judoshiai"   "$libdir/bin/"
    
  install -m755 "$srcdir/js-build/judotimer/$obj/judotimer"   "$libdir/bin/"
    
  install -m755 "$srcdir/js-build/judoinfo/$obj/judoinfo"     "$libdir/bin/"
    
  install -m755 "$srcdir/js-build/judoweight/$obj/judoweight" "$libdir/bin/"
    
  install -m755 "$srcdir/js-build/judojudogi/$obj/judojudogi" "$libdir/bin/"
    
  install -m755 "$srcdir/js-build/utils/$obj/db-convert"      "$libdir/bin/"
    
      129
    
  # Resource trees
    
  cp -a etc            "$libdir/"
    
  # Prebuilt Flutter web UI (from upstream .deb, fetched in build()). httpd.c
    
  # serves browser requests for /web/* from installation_dir/etc/web.
    
  cp -a "$srcdir/deb-extract/usr/lib/judoshiai/etc/web" "$libdir/etc/"
    
  cp -a svg            "$libdir/"
    
  cp -a svg-lisp       "$libdir/"
    
  cp -a svg-lua        "$libdir/"
    
  cp -a custom-examples "$libdir/"
    
  cp -a share          "$libdir/" 2>/dev/null || true
    
      140
    
  # Translations (.mo built by common/Makefile locale target)
    
  declare -A langs=(
    
      [fi]=fi_FI [sv]=sv_SE [es]=es_ES [et]=et_EE [uk]=uk_UA [is]=is_IS
    
      [nb]=nb_NO [pl]=pl_PL [sk]=sk_SK [nl]=nl_NL [cs]=cs_CZ [de]=de_DE
    
      [da]=da_DK [he]=he_IL [fr]=fr_FR [fa]=fa_IR [en_CA]=en_CA
    
      [fr_CA]=fr_CA [en_US]=en_US [it]=it_IT
    
  )
    
  for dir in "${!langs[@]}"; do
    
      local src="common/judoshiai-${langs[$dir]}.mo"
    
      [[ -f $src ]] || continue
    
      install -Dm644 "$src" "$pkgdir/usr/share/locale/$dir/LC_MESSAGES/judoshiai.mo"
    
  done
    
      153
    
  # /usr/bin launchers
    
  install -dm755 "$pkgdir/usr/bin"
    
  for b in judoshiai judotimer judoinfo judoweight judojudogi; do
    
      ln -sf "/usr/lib/judoshiai/bin/$b" "$pkgdir/usr/bin/$b"
    
  done
    
      159
    
  # Desktop + icons + mime
    
  install -dm755 "$pkgdir/usr/share/applications" \
    
                 "$pkgdir/usr/share/pixmaps" \
    
                 "$pkgdir/usr/share/icons/hicolor/48x48/apps" \
    
                 "$pkgdir/usr/share/mime/packages"
    
  for d in judoshiai judotimer judoinfo judoweight judojudogi; do
    
      install -m644 "gnome/$d.desktop" "$pkgdir/usr/share/applications/"
    
      install -m644 "etc/png/$d.png"   "$pkgdir/usr/share/pixmaps/"
    
      install -m644 "etc/png/$d.png"   "$pkgdir/usr/share/icons/hicolor/48x48/apps/"
    
  done
    
  install -m644 gnome/judoshiai.xml "$pkgdir/usr/share/mime/packages/"
    
      171
    
  # Licenses
    
  install -dm755 "$pkgdir/usr/share/licenses/$pkgname"
    
  install -m644 licenses/COPYING "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
  cp -a licenses/* "$libdir/" 2>/dev/null || true
    
      176
    
  # lua5.4 runtime soname alias (binary linked against liblua5.4.so.0)
    
  install -dm755 "$pkgdir/usr/lib"
    
  ln -sf /usr/lib/liblua.so "$pkgdir/usr/lib/liblua5.4.so.0"
    
      180}
    
      181

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2