mangayomi

LOW

maintainer DeepChirp 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The flagged 'external install via cargo' refers to installing 'flutter_rust_bridge_codegen' from crates.io, which is a standard, trusted Rust registry used for building the project; this is a normal part of the build process and not a malicious or supply-chain-risky action.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The flagged 'external install via cargo' refers to installing 'flutter_rust_bridge_codegen' from crates.io, which is a standard, trusted Rust registry used for building the project; this is a normal part of the build process and not a malicious or supply-chain-risky action.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:56 cargo install 'flutter_rust_bridge_codegen'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: DeepChirp <deepchirp@archlinuxcn.org>
    
      2
    
      3pkgname=mangayomi
    
      4pkgver=0.9.9
    
      5pkgrel=2
    
      6pkgdesc="free and open source application for reading manga, novels, and watching animes"
    
      7url="https://github.com/kodjodevf/${pkgname}"
    
      8license=('Apache-2.0')
    
      9arch=('x86_64')
    
      10depends=(
    
      11    'alsa-lib'
    
      12    'at-spi2-core'
    
      13    'cairo'
    
      14    'fontconfig'
    
      15    'glib2'
    
      16    'glibc'
    
      17    'gtk3'
    
      18    'hicolor-icon-theme'
    
      19    'libepoxy'
    
      20    'libgcc'
    
      21    'libsecret'
    
      22    'libsoup3'
    
      23    'libstdc++'
    
      24    'mpv'
    
      25    'pango'
    
      26    'webkit2gtk-4.1'
    
      27)
    
      28makedepends=(
    
      29    'clang'
    
      30    'cmake'
    
      31    'fvm'
    
      32    'lld'
    
      33    'ninja'
    
      34    'patchelf'
    
      35    'rustup' # `Cargokit` expects to find `rustup`; otherwise, it will throw an error during the build process
    
      36    'unzip'
    
      37)
    
      38options=("!lto") # Due to differences in LLVM versions, errors occur when using LTO.
    
      39source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz")
    
      40sha256sums=('2595daa6e13de2cd3763f27ac20110826a565593441e99e11f2c14b43709067e')
    
      41
    
      42prepare() {
    
      43    cd "${pkgname}-${pkgver}"
    
      44
    
      45    sed -i 's/ -Werror//' linux/CMakeLists.txt
    
      46
    
      47    export RUSTUP_HOME="${srcdir}/rustup-home"
    
      48    export CARGO_HOME="${srcdir}/cargo-home"
    
      49    export PATH="${CARGO_HOME}/bin:${PATH}"
    
      50    export RUSTUP_TOOLCHAIN=stable
    
      51
    
      52    fvm use stable
    
      53    fvm flutter --disable-analytics
    
      54    fvm flutter pub get
    
      55
    
      56    cargo install 'flutter_rust_bridge_codegen'
    
      57
    
      58    cd rust
    
      59    cargo fetch --locked --target "$CARCH-unknown-linux-gnu"
    
      60}
    
      61
    
      62build() {
    
      63    cd "${pkgname}-${pkgver}"
    
      64
    
      65    # use `gcc` will get error such as `Walloc-size-larger-than`
    
      66    export CC=clang
    
      67    export CXX=clang++
    
      68
    
      69    export RUSTUP_HOME="${srcdir}/rustup-home"
    
      70    export CARGO_HOME="${srcdir}/cargo-home"
    
      71    export PATH="${CARGO_HOME}/bin:${PATH}"
    
      72    export RUSTUP_TOOLCHAIN=stable
    
      73
    
      74    fvm flutter build linux --no-pub --release
    
      75}
    
      76
    
      77package() {
    
      78    cd "${pkgname}-${pkgver}"
    
      79
    
      80    install -dm755 "${pkgdir}/opt/${pkgname}"
    
      81    cp -rd --no-preserve=ownership --preserve=mode build/linux/x64/release/bundle/* "${pkgdir}/opt/${pkgname}/"
    
      82
    
      83    install -dm755 "${pkgdir}/usr/bin"
    
      84    ln -s "/opt/${pkgname}/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      85
    
      86    install -dm755 "${pkgdir}/usr/share/icons"
    
      87    cp -rL --no-preserve=ownership --preserve=mode linux/packaging/icons/* "${pkgdir}/usr/share/icons/"
    
      88
    
      89    install -Dm644 "linux/${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      90
    
      91    find "${pkgdir}/opt/${pkgname}/lib" -type f -name "*.so" -exec patchelf --set-rpath '$ORIGIN' {} \;
    
      92}
    
      93

Changes since previous scan

--- PKGBUILD @ 2026-10-16 00:12
+++ PKGBUILD @ 2026-11-01 00:21
@@ -2,7 +2,7 @@
 
 pkgname=mangayomi
 pkgver=0.9.9
-pkgrel=1
+pkgrel=2
 pkgdesc="free and open source application for reading manga, novels, and watching animes"
 url="https://github.com/kodjodevf/${pkgname}"
 license=('Apache-2.0')
@@ -47,8 +47,7 @@
     export RUSTUP_HOME="${srcdir}/rustup-home"
     export CARGO_HOME="${srcdir}/cargo-home"
     export PATH="${CARGO_HOME}/bin:${PATH}"
-
-    rustup default stable
+    export RUSTUP_TOOLCHAIN=stable
 
     fvm use stable
     fvm flutter --disable-analytics
@@ -70,6 +69,7 @@
     export RUSTUP_HOME="${srcdir}/rustup-home"
     export CARGO_HOME="${srcdir}/cargo-home"
     export PATH="${CARGO_HOME}/bin:${PATH}"
+    export RUSTUP_TOOLCHAIN=stable
 
     fvm flutter build linux --no-pub --release
 }

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 15:16:11	Medium	1
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2