macopix-cloudef

maintainer grawity · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a legitimate git fork and includes additional mascot data files from a non-whitelisted but benign personal host; these are non-executable assets, and checksums are provided for all downloads except the git source, which is expected.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a legitimate git fork and includes additional mascot data files from a non-whitelisted but benign personal host; these are non-executable assets, and checksums are provided for all downloads except the git source, which is expected.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 "http://rosegray.sakura.ne.jp/macopix/macopix-mascot-HxB-euc-ja-0.30.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1pkgname=macopix-cloudef
    
      2pkgver=1.7.4+cloudef8
    
      3pkgrel=2
    
      4pkgdesc="Mascot Constructive Pilot for X – Cloudef's fork"
    
      5url="https://github.com/Cloudef/macopix-fork"
    
      6arch=(i686 x86_64)
    
      7license=(GPL2 LGPL2.1)
    
      8depends=(gtk2 openssl)
    
      9makedepends=(git)
    
      10provides=(macopix=$pkgver)
    
      11conflicts=(macopix)
    
      12source=("git+https://github.com/Cloudef/macopix-fork"
    
      13	"http://rosegray.sakura.ne.jp/macopix/macopix-mascot-HxB-euc-ja-0.30.tar.gz"
    
      14	"http://rosegray.sakura.ne.jp/macopix/macopix-mascot-marimite-euc-ja-2.20.tar.gz"
    
      15	"http://rosegray.sakura.ne.jp/macopix/macopix-mascot-cosmos-euc-ja-1.02.tar.gz"
    
      16	"http://rosegray.sakura.ne.jp/macopix/macopix-mascot-mizuiro-euc-ja-1.02.tar.gz"
    
      17	"http://rosegray.sakura.ne.jp/macopix/macopix-mascot-pia2-euc-ja-1.02.tar.gz"
    
      18	"http://rosegray.sakura.ne.jp/macopix/macopix-mascot-tsukihime-euc-ja-1.02.tar.gz"
    
      19	"http://rosegray.sakura.ne.jp/macopix/macopix-mascot-triangle_heart-euc-ja-1.02.tar.gz"
    
      20	"http://rosegray.sakura.ne.jp/macopix/macopix-mascot-comic_party-euc-ja-1.02.tar.gz"
    
      21	"http://rosegray.sakura.ne.jp/macopix/macopix-mascot-kanon-euc-ja-1.02.tar.gz"
    
      22	"http://rosegray.sakura.ne.jp/macopix/macopix-mascot-one-euc-ja-1.02.tar.gz")
    
      23sha256sums=('SKIP'
    
      24            '3e8ca25e163a97fca12e1a134943a7815e245c779ff88e9444b7af5ee117f4fb'
    
      25            'dd64c0834032dd37b83dc5f660dc813fcb0c514f3331f942afc61ff483126418'
    
      26            'e39ef6da31f8f8c4c9c8a50fe0e1e00800fe7258b51d1cb4a9b6512962f8a3aa'
    
      27            'f57a40f8b107f862162ce40d07f2237670b850af353b4b3ca880e7190e4e104f'
    
      28            'b3ae2b2480173673010f91fd0864249e05bd990af9af9fccddd43a2bd829d76b'
    
      29            '6dcf1add046046f45ad9b23ed174b22537e23cfa3686b6bc84f607bd34a7ea8e'
    
      30            '5849b6e40a8037e0739b523aed7b597cb2464418bb922d7917dd95c7ed65cdef'
    
      31            '3dbdcd20f2f1f99062263b70bcef92e31f81b1e3e6c62ac0de8f71df83cb1983'
    
      32            '3b2b1d6cbc5f413404680866e2e4506e6ec081af7f90dfa015f5674c8454729b'
    
      33            'd365e516557fd6f3826d9086f7348c3e444256371cac87f901078ece7c118454')
    
      34
    
      35pkgver() {
    
      36	cd macopix-fork
    
      37	echo 1.7.4+cloudef$(git rev-list --count HEAD)
    
      38}
    
      39
    
      40build() {
    
      41	cd macopix-fork
    
      42	./configure --prefix=/usr
    
      43	make CFLAGS+=" -fcommon" LDFLAGS+=" -lX11"
    
      44}
    
      45
    
      46package() {
    
      47	cd macopix-fork
    
      48	make DESTDIR="$pkgdir" install
    
      49	mkdir -p "$pkgdir"/usr/share/macopix/pixmap
    
      50
    
      51	if [[ ${INSTALL_MASCOTS:-y} == y ]]; then
    
      52		for _dir in ../macopix-mascot-*/; do
    
      53			cd $_dir
    
      54			cp -av *.menu *.mcpx "$pkgdir"/usr/share/macopix/
    
      55			cp -av *.png "$pkgdir"/usr/share/macopix/pixmap/
    
      56		done
    
      57	fi
    
      58}
    
      59

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2