libsf3

LOW

maintainer shinmera 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is a C library tarball from the project's own official domain, building from source is normal for AUR, and the host, while not standard, is plausibly controlled by the project maintainer.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a C library tarball from the project's own official domain, building from source is normal for AUR, and the host, while not standard, is plausibly controlled by the project maintainer.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://shirakumo.org/projects/$pkgname/archive/$pkgver-b.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yukari Hafner <shinmera@tymoon.eu>
    
      2pkgname=libsf3
    
      3pkgver=1.1
    
      4pkgrel=2
    
      5epoch=0
    
      6pkgdesc="C library to parse Simple File Format Family (SF3) files"
    
      7arch=('i686' 'x86_64' 'aarch64' 'armv7h' 'riscv64')
    
      8url="https://github.com/shirakumo/libsf3"
    
      9license=('zlib')
    
      10groups=()
    
      11options=()
    
      12makedepends=('doxygen' 'cmake')
    
      13source=("https://shirakumo.org/projects/$pkgname/archive/$pkgver-b.tar.gz")
    
      14b2sums=('c4531de7574a88979b0d278768274981eb1b6393760505e2302545e7b6370ef828c85f9344f7daa90dab65a7f58f12b79724234d75da648a1bcc9d33cb6b35af')
    
      15
    
      16prepare() {
    
      17    mkdir -p "$pkgname-$pkgver/build/"
    
      18}
    
      19
    
      20build() {
    
      21    cmake -S "$pkgname" -B "$pkgname-$pkgver/build" -DBUILD_TESTER=OFF -DCMAKE_INSTALL_PREFIX:PATH=/usr
    
      22    cmake --build "$pkgname-$pkgver/build" -j
    
      23}
    
      24
    
      25package() {
    
      26    cmake --install "$pkgname-$pkgver/build" --prefix "$pkgdir/"
    
      27}
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2