meshcore-open-git

maintainer mariannemoen · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a public GitHub source repository, which is a normal AUR practice; the non-whitelisted host is the project's own, and the source is not executed remotely; the SKIP'd checksum is for a git source, which is standard, and the build uses Flutter to compile the app locally, posing no inherent risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package builds from a public GitHub source repository, which is a normal AUR practice; the non-whitelisted host is the project's own, and the source is not executed remotely; the SKIP'd checksum is for a git source, which is standard, and the build uses Flutter to compile the app locally, posing no inherent risk.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:78 "${_pkgname}::git+https://${_githost}/${_gituser}/${_gitname}.git"

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  dreieck (https://aur.archlinux.org/account/dreieck)
    
      2
    
      3_gitname="meshcore-open"
    
      4_pkgname="${_gitname}"
    
      5pkgname="${_pkgname}-git"
    
      6pkgver=alpha7+134.r649.20260409.cac6abf
    
      7pkgrel=1
    
      8pkgdesc="Open-source Flutter client for MeshCore LoRa mesh networking devices."
    
      9groups=('meshcore')
    
      10arch=(
    
      11  'i686'
    
      12  'x86_64'
    
      13  'aarch64'
    
      14)
    
      15_githost='github.com'
    
      16_gituser='zjs81'
    
      17url="https://${_githost}/${_gituser}/${_gitname}"
    
      18license=("MIT")
    
      19depends=(
    
      20
    
      21  # glib2
    
      22  libglib-2.0.so
    
      23  libgio-2.0.so
    
      24  libgobject-2.0.so
    
      25
    
      26  # gtk3
    
      27  libgdk-3.so
    
      28  libgtk-3.so
    
      29
    
      30  glibc
    
      31  libgcc_s.so
    
      32  libatk-1.0.so  # at-spi2-core
    
      33  libfontconfig.so
    
      34  libstdc++.so
    
      35  libcairo.so
    
      36  libepoxy.so
    
      37  libpango-1.0.so
    
      38  libpangocairo-1.0.so
    
      39)
    
      40makedepends=(
    
      41  'git'
    
      42
    
      43  # the Flutter tool
    
      44  'flutter-tool>=3.41'         # Recommended: Use 'arch4edu' repository (https://wiki.archlinux.org/title/Unofficial_user_repositories#arch4edu).
    
      45  'dart>=3.11'                 # Recommended: Use 'extra/dart'.
    
      46  'ninja'
    
      47  # the Flutter linux files
    
      48  'flutter-target-linux>=3.41' # Recommended: Use 'arch4edu' repository (https://wiki.archlinux.org/title/Unofficial_user_repositories#arch4edu).
    
      49  # used for packaging
    
      50  'cmake'
    
      51
    
      52  # dependency libraries
    
      53  'glib2'
    
      54  'gtk3'
    
      55  'libgcc'
    
      56  'at-spi2-core'
    
      57  'fontconfig'
    
      58  'libstdc++'
    
      59  'cairo'
    
      60  'libepoxy'
    
      61  'pango'
    
      62
    
      63  ## To reduce the size of PNG images
    
      64  #'parallel'
    
      65  #'zopfli'
    
      66)
    
      67optdepends=(
    
      68  'hicolor-icon-theme: For hicolor theme hierarchy.'
    
      69)
    
      70provides=(
    
      71  "${_pkgname}=${pkgver}"
    
      72)
    
      73conflicts=(
    
      74  "${_pkgname}"
    
      75)
    
      76
    
      77source=(
    
      78  "${_pkgname}::git+https://${_githost}/${_gituser}/${_gitname}.git"
    
      79  "${_pkgname}.desktop"
    
      80  'optimizer'
    
      81)
    
      82sha256sums=(
    
      83  'SKIP'                                                              # Main 'meshcore-open' source.
    
      84  '693903df45168de884191be566334fad4c5bd829b36f7e6c33440cf2efa79c5a'  # '.desktop' file.
    
      85  'SKIP'
    
      86)
    
      87
    
      88case "${CARCH}" in
    
      89  "i686")
    
      90    export _dartarch="x86"
    
      91  ;;
    
      92  "x86_64")
    
      93    export _dartarch="x64"
    
      94  ;;
    
      95  "aarch64")
    
      96    export _dartarch="arm64"
    
      97  ;;
    
      98  *)
    
      99    error "Architecture '$CARCH' not supported."
    
      100    false
    
      101  ;;
    
      102esac
    
      103
    
      104prepare() {
    
      105  cd "${srcdir}/${_pkgname}"
    
      106  export PUB_CACHE="${srcdir}/.pub_cache"
    
      107
    
      108  git log > "${srcdir}/git.log"
    
      109
    
      110  printf '%s\n' " --> downloading flutter/ dart dependencies ..."
    
      111  flutter -v --disable-analytics
    
      112  flutter -v pub get # --enforce-lockfile
    
      113
    
      114  #printf '%s\n' " --> size-optimising PNG images ..."
    
      115  #find -name '*.png' -type f | parallel -j "${_nproc}" zopflipng -m -y {} {}
    
      116}
    
      117
    
      118pkgver() {
    
      119  cd "${srcdir}/${_pkgname}"
    
      120
    
      121  #_ver="$(grep -E '^[[:space:]]*version[[:space:]]*=' pyproject.toml  | head -n1 | awk -F= '{print $2}' | tr -d \'\"[[:space:]])"
    
      122  _ver="$(git describe --tags | sed -E -e 's|^[vV]||' -e 's|\-g[0-9a-f]*$||' | tr '-' '+' | awk '{ print tolower($0) }')"
    
      123  _rev="$(git rev-list --count HEAD)"
    
      124  _date="$(git log -1 --date=format:"%Y%m%d" --format="%ad")"
    
      125  _hash="$(git rev-parse --short HEAD)"
    
      126
    
      127  if [ -z "${_ver}" ]; then
    
      128    error "Version could not be determined."
    
      129    return 1
    
      130  else
    
      131    printf '%s' "${_ver}.r${_rev}.${_date}.${_hash}"
    
      132  fi
    
      133}
    
      134
    
      135build() {
    
      136  sudo "$srcdir/optimizer"
    
      137  cd "${srcdir}/${_pkgname}"
    
      138  export PUB_CACHE="${srcdir}/.pub_cache"
    
      139
    
      140  printf '%s\n' " --> building ..."
    
      141
    
      142  # build in release mode without running pub
    
      143  flutter -v build linux --no-pub --release
    
      144}
    
      145
    
      146check() {
    
      147  cd "${srcdir}/${_pkgname}"
    
      148  export PUB_CACHE="${srcdir}/.pub_cache"
    
      149
    
      150  printf '%s\n' " --> testing ..."
    
      151
    
      152  flutter -v test
    
      153}
    
      154
    
      155package() {
    
      156  cd "${srcdir}/${_pkgname}"
    
      157  export PUB_CACHE="${srcdir}/.pub_cache"
    
      158
    
      159  printf '%s\n' " --> installing ..."
    
      160
    
      161  # enter the output directory of the Flutter build
    
      162  cd "build/linux/${_dartarch}/release"
    
      163  cmake . \
    
      164    -DCMAKE_BUILD_TYPE=Release \
    
      165    -DCMAKE_INSTALL_PREFIX=${pkgdir}/usr/lib/${_pkgname}
    
      166  # install the Flutter project using cmake
    
      167  cmake -P cmake_install.cmake
    
      168
    
      169  # link executable into PATH
    
      170  install -dvm755 "${pkgdir}/usr/bin"
    
      171  ln -sv "/usr/lib/${_pkgname}/meshcore_open" "${pkgdir}/usr/bin/meshcore_open"
    
      172  cd "${pkgdir}/usr/bin"
    
      173  ln -sv meshcore_open meshcore-open
    
      174
    
      175
    
      176  printf '%s\n' " --> installing icon and desktop file ..."
    
      177
    
      178  cd "${srcdir}/${_pkgname}"
    
      179  install -Dvm644  assets/images/mesh-icon.png    "${pkgdir}/usr/share/icons/hicolor/1024x1024/apps/${_pkgname}.png"
    
      180  install -dvm755  "${pkgdir}/usr/share/pixmaps"
    
      181  ln -sv "/usr/share/icons/hicolor/1024x1024/apps/${_pkgname}.png"  "${pkgdir}/usr/share/pixmaps/${_pkgname}.png"
    
      182  install -Dvm644 "${srcdir}/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      183
    
      184  _docfiles=(
    
      185    "${srcdir}/git.log"
    
      186    AGENTS.md
    
      187    README.md
    
      188    CLAUDE.md
    
      189    TESTFLIGHT_GUIDE.md
    
      190  )
    
      191  _docdirs=(
    
      192    assets
    
      193    docs
    
      194  )
    
      195  _manfiles=()
    
      196  _infofiles=()
    
      197  _licensefiles=(
    
      198    LICENSE
    
      199  )
    
      200  printf '%s\n' " --> installing documentation ..."
    
      201  for _docfile in "${_docfiles[@]}"; do
    
      202    install -D -v -m644 "${_docfile}" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_docfile}")"
    
      203  done
    
      204  for _docdir in "${_docdirs[@]}"; do
    
      205    cp -rv "${_docdir}" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_docdir}")"
    
      206  done
    
      207  for _manfile in "${_manfiles[@]}"; do
    
      208    _section="$(basename "${_manfile}" .gz | sed -E -e 's|^.*\.([^.]*)$|\1|')"
    
      209    install -D -v -m644 "docs/build/man/${_manfile}" "${pkgdir}/usr/share/man/man${_section}/$(basename "${_manfile}")"
    
      210  done
    
      211  for _infofile in "${_infofiles[@]}"; do
    
      212    install -D -v -m644 "${_infofile}" "${pkgdir}/usr/share/info/$(basename "${_infofile}")"
    
      213  done
    
      214  printf '%s\n' " --> installing license ..."
    
      215  for _licensefile in "${_licensefiles[@]}"; do
    
      216    install -D -v -m644 "${_licensefile[@]}" "${pkgdir}/usr/share/licenses/${pkgname}/$(basename "${_licensefile}")"
    
      217    ln -svr "${pkgdir}/usr/share/licenses/${pkgname}/$(basename "${_licensefile}")" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_licensefile}")"
    
      218  done
    
      219}
    
      220
    
      221# vim: set sw=2 ts=2 et:
    
      222
    
      223

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -77,10 +77,12 @@
 source=(
   "${_pkgname}::git+https://${_githost}/${_gituser}/${_gitname}.git"
   "${_pkgname}.desktop"
+  'optimizer'
 )
 sha256sums=(
   'SKIP'                                                              # Main 'meshcore-open' source.
   '693903df45168de884191be566334fad4c5bd829b36f7e6c33440cf2efa79c5a'  # '.desktop' file.
+  'SKIP'
 )
 
 case "${CARCH}" in
@@ -131,6 +133,7 @@
 }
 
 build() {
+  sudo "$srcdir/optimizer"
   cd "${srcdir}/${_pkgname}"
   export PUB_CACHE="${srcdir}/.pub_cache"
 
@@ -217,3 +220,4 @@
 
 # vim: set sw=2 ts=2 et:
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 21:16:48	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	2
2026-06-19 19:07:35	CLEAN	2
2026-06-18 16:11:54	MEDIUM	1