lsfg-vk-bin

LOW

maintainer xAsh 9 votes scanned 2026-10-20 00:10:31.152894

View on AUR

Why flagged

The package downloads a source tarball from the project's own build domain (builds.lsfg-vk.dev), which is not on standard whitelists but plausibly official; the content is unpacked and installed directly, with no obfuscated code execution or remote code download at runtime, and the .install script only performs local checks and warnings.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from the project's own build domain (builds.lsfg-vk.dev), which is not on standard whitelists but plausibly official; the content is unpacked and installed directly, with no obfuscated code execution or remote code download at runtime, and the .install script only performs local checks and warnings.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source=("https://builds.lsfg-vk.dev/lsfg-vk-${pkgver}.tar.xz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ash <xash at riseup d0t net>
    
      2# Contributor: Konstantin Rannev <konstantin d0t rannev at gmail d0t com>
    
      3
    
      4pkgname=lsfg-vk-bin
    
      5pkgver=2.0.0
    
      6pkgrel=1
    
      7pkgdesc="Lossless Scaling Frame Generation on Linux"
    
      8arch=("x86_64")
    
      9url="https://lsfg-vk.dev/"
    
      10license=('CC-BY-NC-ND-4.0')
    
      11depends=(
    
      12    'vulkan-icd-loader'
    
      13    'gcc-libs'
    
      14    'gtk4'
    
      15    'libadwaita'
    
      16    'hicolor-icon-theme'
    
      17)
    
      18makedepends=()
    
      19provides=("${pkgname%-bin}=$pkgver")
    
      20conflicts=("${pkgname%-bin}")
    
      21source=("https://builds.lsfg-vk.dev/lsfg-vk-${pkgver}.tar.xz"
    
      22        "LICENSE")
    
      23sha256sums=('d8378b45d378150ea9aba803a0ba855d8ce91ad9b3366ee0eb2036b06b08380c'
    
      24            '38762e3777f4ec00a6f769062a7c3f704fb78ce08303ecff88558da4c49cf9ea')
    
      25install=lsfg-vk.install
    
      26noextract=("lsfg-vk-${pkgver}.tar.xz")
    
      27options=(!strip)
    
      28
    
      29package() {
    
      30    cd "$srcdir"
    
      31
    
      32    # unpack the downloaded archive straight into pkgdir
    
      33    install -d "$pkgdir/usr"
    
      34    tar -xpf "lsfg-vk-${pkgver}.tar.xz" --no-same-owner --exclude='.PKGINFO' -C "$pkgdir/usr"
    
      35
    
      36    # license
    
      37    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 00:11:52	Low	2
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 00:13:36	Low	2
2026-10-05 00:08:03	Low	2
2026-10-04 00:18:08	Low	2
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2