lectern-git
LOW
maintainer papaya
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The source is a git repository from the maintainer's own domain, used to build the software from source; this is normal AUR packaging behavior despite the non-whitelisted host, and no untrusted prebuilt binaries are executed.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git repository from the maintainer's own domain, used to build the software from source; this is normal AUR packaging behavior despite the non-whitelisted host, and no untrusted prebuilt binaries are executed.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:29
source=('lectern::git+https://git.papayadev.net/pub/lectern.git')
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Papaya <me@papayadev.net>
2
pkgname=lectern-git
3
pkgver=0.5.0
4
pkgrel=1
5
pkgdesc='A configurable, cross-platform markdown viewer'
6
arch=('x86_64')
7
url='https://git.papayadev.net/pub/lectern'
8
license=('LicenseRef-MIT-Commons-Clause')
9
depends=(
10
'gcc-libs'
11
'glibc'
12
'qt6-base'
13
'qt6-svg'
14
'qt6-wayland'
15
'xdg-desktop-portal'
16
'xdg-desktop-portal-impl'
17
)
18
makedepends=(
19
'cargo'
20
'cmake'
21
'git'
22
)
23
optdepends=(
24
'noto-fonts-emoji: color emoji rendering'
25
'xorg-server: X11 support'
26
)
27
provides=('lectern')
28
conflicts=('lectern')
29
source=('lectern::git+https://git.papayadev.net/pub/lectern.git')
30
sha256sums=('SKIP')
31
options=('!lto')
32
33
pkgver() {
34
cd lectern
35
local desc
36
desc=$(git describe --long --tags --abbrev=7 2>/dev/null) || true
37
if [ -n "$desc" ]; then
38
echo "$desc" | sed 's/^v//;s/-/.r/;s/-/./g'
39
else
40
printf '0.5.0.r%s.%s' "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
41
fi
42
}
43
44
prepare() {
45
cd lectern/parser
46
export RUSTUP_TOOLCHAIN=stable
47
cargo fetch --target "$(rustc -vV | sed -n 's/host: //p')"
48
}
49
50
build() {
51
cd lectern
52
export RUSTUP_TOOLCHAIN=stable
53
cmake -B build -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=/usr -DCMAKE_SKIP_RPATH=ON
54
cmake --build build -j$(nproc)
55
}
56
57
package() {
58
cd lectern
59
60
# Binary
61
install -Dm755 "build/lectern" "$pkgdir/usr/bin/lectern"
62
63
# Parser library
64
install -Dm755 "build/liblectern_parser.so" "$pkgdir/usr/lib/liblectern_parser.so"
65
66
# Desktop entry
67
install -Dm644 "assets/lectern.desktop" "$pkgdir/usr/share/applications/lectern.desktop"
68
69
# Icons
70
install -Dm644 "assets/icon.svg" "$pkgdir/usr/share/icons/hicolor/scalable/apps/lectern.svg"
71
install -Dm644 "assets/icon-64.png" "$pkgdir/usr/share/icons/hicolor/64x64/apps/lectern.png"
72
install -Dm644 "assets/icon-128.png" "$pkgdir/usr/share/icons/hicolor/128x128/apps/lectern.png"
73
74
# License
75
install -Dm644 "LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
76
}
77
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |