kitsune

LOW

maintainer kezuwoo 1 votes scanned 2026-10-02 00:00:32.890515

View on AUR

Why flagged

The source is a git repository from a non-standard host, but it is used to build the project from its own source code, which is a normal AUR practice; the risk is low as the code is built locally and the host appears to be project-related.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The source is a git repository from a non-standard host, but it is used to build the project from its own source code, which is a normal AUR practice; the risk is low as the code is built locally and the host appears to be project-related.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 source=("git+https://altlinux.space/armatik/Kitsune.git")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: kezuwoo <kezu15@proton.me>
    
      2
    
      3pkgname=kitsune
    
      4pkgver=1.0.0
    
      5pkgrel=1
    
      6pkgdesc="AniLiberty player"
    
      7arch=('any')
    
      8url="https://altlinux.space/armatik/Kitsune"
    
      9license=('GPL-3.0-or-later')
    
      10
    
      11depends=(
    
      12'python'
    
      13'python-gobject'
    
      14'python-cairo'
    
      15'python-keyring'
    
      16'libadwaita'
    
      17'gtk4'
    
      18'gstreamer'
    
      19'gst-plugins-base'
    
      20'gst-plugins-good'
    
      21'gst-plugins-bad'
    
      22'gst-plugin-gtk4'
    
      23)
    
      24
    
      25makedepends=('meson' 'ninja' 'git' 'blueprint-compiler')
    
      26
    
      27source=("git+https://altlinux.space/armatik/Kitsune.git")
    
      28sha256sums=('SKIP')
    
      29
    
      30pkgver() {
    
      31  cd "$srcdir/Kitsune"
    
      32  git describe --tags --abbrev=0 | sed 's/^v//'
    
      33}
    
      34
    
      35build() {
    
      36  cd "$srcdir/Kitsune"
    
      37  meson setup build --prefix=/usr
    
      38  meson compile -C build
    
      39}
    
      40
    
      41package() {
    
      42    cd "$srcdir/Kitsune"
    
      43    DESTDIR="$pkgdir" meson install -C build
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2
2026-09-27 00:07:07	Low	2
2026-09-26 00:12:15	Low	2
2026-09-25 00:03:36	Low	2
2026-09-24 00:24:14	Low	2
2026-09-23 00:28:13	Low	2
2026-09-22 00:15:14	Low	2
2026-09-21 00:26:32	Low	2
2026-09-20 00:25:31	Low	2
2026-09-19 00:25:36	Low	2
2026-09-18 00:17:11	Low	2
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2