kitsune

maintainer kezuwoo · 1 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The source is a git repository from a non-standard host, but it is used to build the project from its own source code, which is a normal AUR practice; the risk is low as the code is built locally and the host appears to be project-related.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The source is a git repository from a non-standard host, but it is used to build the project from its own source code, which is a normal AUR practice; the risk is low as the code is built locally and the host appears to be project-related.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 source=("git+https://altlinux.space/armatik/Kitsune.git")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: kezuwoo <kezu15@proton.me>
    
      2
    
      3pkgname=kitsune
    
      4pkgver=1.0.0
    
      5pkgrel=1
    
      6pkgdesc="AniLiberty player"
    
      7arch=('any')
    
      8url="https://altlinux.space/armatik/Kitsune"
    
      9license=('GPL-3.0-or-later')
    
      10
    
      11depends=(
    
      12'python'
    
      13'python-gobject'
    
      14'python-cairo'
    
      15'python-keyring'
    
      16'libadwaita'
    
      17'gtk4'
    
      18'gstreamer'
    
      19'gst-plugins-base'
    
      20'gst-plugins-good'
    
      21'gst-plugins-bad'
    
      22'gst-plugin-gtk4'
    
      23)
    
      24
    
      25makedepends=('meson' 'ninja' 'git' 'blueprint-compiler')
    
      26
    
      27source=("git+https://altlinux.space/armatik/Kitsune.git")
    
      28sha256sums=('SKIP')
    
      29
    
      30pkgver() {
    
      31  cd "$srcdir/Kitsune"
    
      32  git describe --tags --abbrev=0 | sed 's/^v//'
    
      33}
    
      34
    
      35build() {
    
      36  cd "$srcdir/Kitsune"
    
      37  meson setup build --prefix=/usr
    
      38  meson compile -C build
    
      39}
    
      40
    
      41package() {
    
      42    cd "$srcdir/Kitsune"
    
      43    DESTDIR="$pkgdir" meson install -C build
    
      44}
    
      45

Changes since previous scan

--- PKGBUILD @ 2026-06-20 00:18
+++ PKGBUILD @ 2026-08-18 00:03
@@ -1,7 +1,7 @@
 # Maintainer: kezuwoo <kezu15@proton.me>
 
 pkgname=kitsune
-pkgver=0.8.5
+pkgver=1.0.0
 pkgrel=1
 pkgdesc="AniLiberty player"
 arch=('any')
@@ -12,6 +12,7 @@
 'python'
 'python-gobject'
 'python-cairo'
+'python-keyring'
 'libadwaita'
 'gtk4'
 'gstreamer'
@@ -19,7 +20,6 @@
 'gst-plugins-good'
 'gst-plugins-bad'
 'gst-plugin-gtk4'
-'python-requests'
 )
 
 makedepends=('meson' 'ninja' 'git' 'blueprint-compiler')

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 00:17:07	LOW	2
2026-08-12 00:27:08	LOW	2
2026-08-11 13:21:13	MEDIUM	1
2026-06-20 00:18:46	MEDIUM	1
2026-06-19 23:51:18	CLEAN	2
2026-06-19 19:07:35	LOW	2
2026-06-18 16:11:54	MEDIUM	1