mangohud-mangochill

maintainer farnoy · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from source code hosted on the maintainer's GitHub and wrapdb.mesonbuild.com, which are plausible project-owned or community infrastructure; despite non-whitelisted hosts and skipped checksums, all fetched content consists of source code or patches used to build the software, with no evidence of remote code execution or malicious payloads.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source code hosted on the maintainer's GitHub and wrapdb.mesonbuild.com, which are plausible project-owned or community infrastructure; despite non-whitelisted hosts and skipped checksums, all fetched content consists of source code or patches used to build the software, with no evidence of remote code execution or malicious payloads.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 'imgui-wrap.zip::https://wrapdb.mesonbuild.com/v2/imgui_1.91.6-3/get_patch'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: farnoy
    
      2# Based on Arch Linux mangohud PKGBUILD & nixpkgs
    
      3
    
      4_pkgname=MangoHud
    
      5pkgname=mangohud-mangochill
    
      6pkgver=0.8.2
    
      7pkgrel=1
    
      8pkgdesc='MangoHud fork with MangoChill control socket support'
    
      9arch=('x86_64')
    
      10url='https://github.com/farnoy/MangoHud'
    
      11license=('MIT')
    
      12makedepends=('appstream' 'cmocka' 'git' 'glslang' 'libxnvctrl' 'libxrandr' 'meson' 'python-mako' 'vulkan-headers' 'unzip')
    
      13depends=('dbus' 'fmt' 'glfw' 'hicolor-icon-theme' 'libglvnd' 'libx11' 'libxkbcommon' 'python' 'python-matplotlib' 'python-numpy' 'spdlog' 'vulkan-icd-loader' 'wayland')
    
      14optdepends=('gamescope: use MangoApp as an overlay within gamescope'
    
      15            'libxnvctrl: NVIDIA GPU stats by XNVCtrl')
    
      16provides=('mangohud')
    
      17conflicts=('mangohud' 'mangohud-git')
    
      18source=(
    
      19  "$_pkgname::git+https://github.com/farnoy/MangoHud.git#commit=ae5a7dcf49227af0548cfd4d11ae3754c2fb9cb8"
    
      20  'imgui-1.91.6.tar.gz::https://github.com/ocornut/imgui/archive/refs/tags/v1.91.6.tar.gz'
    
      21  'implot-0.16.tar.gz::https://github.com/epezent/implot/archive/refs/tags/v0.16.tar.gz'
    
      22  'Vulkan-Headers-1.3.283.tar.gz::https://github.com/KhronosGroup/Vulkan-Headers/archive/refs/tags/v1.3.283.tar.gz'
    
      23  'imgui-wrap.zip::https://wrapdb.mesonbuild.com/v2/imgui_1.91.6-3/get_patch'
    
      24  'implot-wrap.zip::https://wrapdb.mesonbuild.com/v2/implot_0.16-1/get_patch'
    
      25  'vulkan-headers-wrap.zip::https://wrapdb.mesonbuild.com/v2/vulkan-headers_1.3.283-1/get_patch'
    
      26)
    
      27sha256sums=('SKIP'
    
      28            'SKIP'
    
      29            'SKIP'
    
      30            'SKIP'
    
      31            'SKIP'
    
      32            'SKIP'
    
      33            'SKIP')
    
      34
    
      35prepare() {
    
      36  cd "$_pkgname"
    
      37
    
      38  cp -a "$srcdir/imgui-1.91.6" subprojects/
    
      39  cp -a "$srcdir/implot-0.16" subprojects/
    
      40  cp -a "$srcdir/Vulkan-Headers-1.3.283" subprojects/
    
      41
    
      42  (
    
      43    cd subprojects
    
      44    unzip -o "$srcdir/imgui-wrap.zip"
    
      45    unzip -o "$srcdir/implot-wrap.zip"
    
      46    unzip -o "$srcdir/vulkan-headers-wrap.zip"
    
      47  )
    
      48}
    
      49
    
      50build() {
    
      51  arch-meson "$_pkgname" build \
    
      52    -Dmangoapp=true \
    
      53    -Dmangohudctl=true \
    
      54    -Duse_system_spdlog=enabled
    
      55
    
      56  meson compile -C build
    
      57}
    
      58
    
      59check() {
    
      60  meson test -C build --print-errorlogs || :
    
      61}
    
      62
    
      63package() {
    
      64  meson install -C build --destdir "$pkgdir"
    
      65
    
      66  install -Dm644 "$srcdir/$_pkgname/LICENSE" -t "$pkgdir/usr/share/licenses/$pkgname/"
    
      67}
    
      68

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2