meshcore-open-git

LOW
maintainer dreieck 0 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The package builds from a legitimate GitHub source, applies a public patch, and uses standard Flutter tooling; the non-whitelisted host is the project's own repository, and skipped checksum is common for git sources, posing minimal risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a legitimate GitHub source, applies a public patch, and uses standard Flutter tooling; the non-whitelisted host is the project's own repository, and skipped checksum is common for git sources, posing minimal risk.

2 higher static findings superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:87 "${_pkgname}::git+https://${_githost}/${_gituser}/${_gitname}.git"
Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: dreieck (https://aur.archlinux.org/account/dreieck)
2
3_gitname="meshcore-open"
4_pkgname="${_gitname}"
5pkgname="${_pkgname}-git"
6pkgver=alpha9+217.r962.20260903.dbd7f2aa
7pkgrel=2
8pkgdesc="Open-source Flutter client for MeshCore LoRa mesh networking devices."
9groups=('meshcore')
10arch=(
11 'i686'
12 'x86_64'
13 'aarch64'
14)
15_githost='github.com'
16_gituser='zjs81'
17url="https://${_githost}/${_gituser}/${_gitname}"
18license=("MIT")
19depends=(
20
21 # glib2
22 libglib-2.0.so
23 libgio-2.0.so
24 libgobject-2.0.so
25
26 # gtk3
27 libgdk-3.so
28 libgtk-3.so
29
30 glibc
31 libgcc_s.so
32 libatk-1.0.so # at-spi2-core
33 libfontconfig.so
34 libstdc++.so
35 libcairo.so
36 libepoxy.so
37 libpango-1.0.so
38 libpangocairo-1.0.so
39)
40makedepends=(
41 # To retrieve the source:
42 'git'
43
44 # Used for packaging
45 'cmake'
46 'ninja'
47
48 ## Flutter and dart recommendations:
49 #
50 # Recommended in 2026-09:
51 # Use aur/flutter-bin (https://aur.archlinux.org/packages/flutter-bin) or chaotic-aur/flutter-bin (https://aur.chaotic.cx/ | https://aur.chaotic.cx/stats/search?search=flutter-bin | https://builds.garudalinux.org/repos/chaotic-aur/x86_64/#:~:text=flutter-bin).
52 #
53 # Recommended in beginning of 2026:
54 # Use 'arch4edu' repository (https://wiki.archlinux.org/title/Unofficial_user_repositories#arch4edu).
55 # This later errored out with "Wrong full snapshot version, expected '0451907c2eaa8467e848c0067bfe8ed4' found '78da37fed6bf1489361a312568249f3f'" or so.
56 'flutter-tool' # >=3.41. # Should be a versioned dependency, but not specifying now since `flutter-bin` does not has a versioned provides entry as of 2026-09-05, see https://aur.archlinux.org/packages/flutter-bin#comment-1084386.
57 'dart' # >=3.11. # Should be a versioned dependency, but not specifying now since `flutter-bin` does not has a versioned provides entry as of 2026-09-05, see https://aur.archlinux.org/packages/flutter-bin#comment-1084386.
58 # the Flutter linux files
59 'flutter-target-linux' # >=3.41. # Should be a versioned dependency, but not specifying now since `flutter-bin` does not has a versioned provides entry as of 2026-09-05, see https://aur.archlinux.org/packages/flutter-bin#comment-1084386.
60
61 # dependency libraries
62 'glib2'
63 'gtk3'
64 'libgcc'
65 'at-spi2-core'
66 'fontconfig'
67 'libstdc++'
68 'cairo'
69 'libepoxy'
70 'pango'
71
72 ## To reduce the size of PNG images
73 #'parallel'
74 #'zopfli'
75)
76optdepends=(
77 'hicolor-icon-theme: For hicolor theme hierarchy.'
78)
79provides=(
80 "${_pkgname}=${pkgver}"
81)
82conflicts=(
83 "${_pkgname}"
84)
85
86source=(
87 "${_pkgname}::git+https://${_githost}/${_gituser}/${_gitname}.git"
88 "flserial_once_flag_fix.patch::https://github.com/MeshEnvy/flserial/pull/1.patch"
89 "${_pkgname}.desktop"
90)
91sha256sums=(
92 'SKIP' # Main 'meshcore-open' source.
93 '0a870e4ca333c53457948cdc6cf31597f090a8291209314c9ac74660d8d8dc08' # 'flserial_once_flag_fix.patch'
94 '693903df45168de884191be566334fad4c5bd829b36f7e6c33440cf2efa79c5a' # '.desktop' file.
95)
96
97case "${CARCH}" in
98 "i686")
99 export _dartarch="x86"
100 ;;
101 "x86_64")
102 export _dartarch="x64"
103 ;;
104 "aarch64")
105 export _dartarch="arm64"
106 ;;
107 *)
108 error "Architecture '$CARCH' not supported."
109 false
110 ;;
111esac
112
113
114_patch_only_if_not_applied() {
115 # Tries to apply a patch and if it already has been applied also return zero exit code.
116 # Arguments:
117 # $1: Patch file to apply.
118 # $2...: Other options to patch.
119 local _patch="$1"
120 shift
121 if ! patch --dry-run -R -i "${_patch}" "$@"; then
122 printf '%s\n' ' `-> Patch not yet applied, applying ...'
123 patch -i "${_patch}" "$@"
124 else
125 printf '%s\n' ' `-> Patch already applied.'
126 fi
127}
128
129prepare() {
130 cd "${srcdir}/${_pkgname}"
131 export PUB_CACHE="${srcdir}/.pub_cache"
132
133 git log > "${srcdir}/git.log"
134
135 printf '%s\n' " --> downloading flutter/ dart dependencies ..."
136 flutter -v --disable-analytics
137 flutter -v pub get # --enforce-lockfile
138
139 # Patch this after downloading flutter dependencies -- since it patches a dependency:
140 local _patch='flserial_once_flag_fix.patch'
141 local _flserialdir
142 for _flserialdir in "${PUB_CACHE}/git"/flserial-[0-9a-f]*; do
143 printf '%s\n' " --> Applying patch '${_patch}' to '${_flserialdir}' ..."
144 _patch_only_if_not_applied "${srcdir}/${_patch}" -Np1 --follow-symlinks -d "${_flserialdir}"
145 done
146
147 #printf '%s\n' " --> size-optimising PNG images ..."
148 #find -name '*.png' -type f | parallel -j "${_nproc}" zopflipng -m -y {} {}
149}
150
151pkgver() {
152 cd "${srcdir}/${_pkgname}"
153
154 #_ver="$(grep -E '^[[:space:]]*version[[:space:]]*=' pyproject.toml | head -n1 | awk -F= '{print $2}' | tr -d \'\"[[:space:]])"
155 _ver="$(git describe --tags | sed -E -e 's|^[vV]||' -e 's|\-g[0-9a-f]*$||' | tr '-' '+' | awk '{ print tolower($0) }')"
156 _rev="$(git rev-list --count HEAD)"
157 _date="$(git log -1 --date=format:"%Y%m%d" --format="%ad")"
158 _hash="$(git rev-parse --short HEAD)"
159
160 if [ -z "${_ver}" ]; then
161 error "Version could not be determined."
162 return 1
163 else
164 printf '%s' "${_ver}.r${_rev}.${_date}.${_hash}"
165 fi
166}
167
168build() {
169 cd "${srcdir}/${_pkgname}"
170 export PUB_CACHE="${srcdir}/.pub_cache"
171
172 printf '%s\n' " --> building ..."
173
174 # build in release mode without running pub
175 flutter -v build linux --no-pub --release
176}
177
178check() {
179 cd "${srcdir}/${_pkgname}"
180 export PUB_CACHE="${srcdir}/.pub_cache"
181
182 printf '%s\n' " --> testing ..."
183
184 flutter -v test
185}
186
187package() {
188 cd "${srcdir}/${_pkgname}"
189 export PUB_CACHE="${srcdir}/.pub_cache"
190
191 printf '%s\n' " --> installing ..."
192
193 # enter the output directory of the Flutter build
194 cd "build/linux/${_dartarch}/release"
195 cmake . \
196 -DCMAKE_BUILD_TYPE=Release \
197 -DCMAKE_INSTALL_PREFIX=${pkgdir}/usr/lib/${_pkgname}
198 # install the Flutter project using cmake
199 cmake -P cmake_install.cmake
200
201 # link executable into PATH
202 install -dvm755 "${pkgdir}/usr/bin"
203 ln -sv "/usr/lib/${_pkgname}/meshcore_open" "${pkgdir}/usr/bin/meshcore_open"
204 cd "${pkgdir}/usr/bin"
205 ln -sv meshcore_open meshcore-open
206
207
208 printf '%s\n' " --> installing icon and desktop file ..."
209
210 cd "${srcdir}/${_pkgname}"
211 install -Dvm644 assets/images/mesh-icon.png "${pkgdir}/usr/share/icons/hicolor/1024x1024/apps/${_pkgname}.png"
212 install -dvm755 "${pkgdir}/usr/share/pixmaps"
213 ln -sv "/usr/share/icons/hicolor/1024x1024/apps/${_pkgname}.png" "${pkgdir}/usr/share/pixmaps/${_pkgname}.png"
214 install -Dvm644 "${srcdir}/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
215
216 _docfiles=(
217 "${srcdir}/git.log"
218 AGENTS.md
219 README.md
220 CLAUDE.md
221 TESTFLIGHT_GUIDE.md
222 )
223 _docdirs=(
224 assets
225 docs
226 )
227 _manfiles=()
228 _infofiles=()
229 _licensefiles=(
230 LICENSE
231 )
232 printf '%s\n' " --> installing documentation ..."
233 for _docfile in "${_docfiles[@]}"; do
234 install -D -v -m644 "${_docfile}" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_docfile}")"
235 done
236 for _docdir in "${_docdirs[@]}"; do
237 cp -rv "${_docdir}" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_docdir}")"
238 done
239 for _manfile in "${_manfiles[@]}"; do
240 _section="$(basename "${_manfile}" .gz | sed -E -e 's|^.*\.([^.]*)$|\1|')"
241 install -D -v -m644 "docs/build/man/${_manfile}" "${pkgdir}/usr/share/man/man${_section}/$(basename "${_manfile}")"
242 done
243 for _infofile in "${_infofiles[@]}"; do
244 install -D -v -m644 "${_infofile}" "${pkgdir}/usr/share/info/$(basename "${_infofile}")"
245 done
246 printf '%s\n' " --> installing license ..."
247 for _licensefile in "${_licensefiles[@]}"; do
248 install -D -v -m644 "${_licensefile[@]}" "${pkgdir}/usr/share/licenses/${pkgname}/$(basename "${_licensefile}")"
249 ln -svr "${pkgdir}/usr/share/licenses/${pkgname}/$(basename "${_licensefile}")" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_licensefile}")"
250 done
251}
252
253# vim: set sw=2 ts=2 et:
254

Changes since previous scan

--- PKGBUILD @ 2026-09-06 00:17
+++ PKGBUILD @ 2026-09-17 00:27
@@ -4,7 +4,7 @@
_pkgname="${_gitname}"
pkgname="${_pkgname}-git"
pkgver=alpha9+217.r962.20260903.dbd7f2aa
-pkgrel=1
+pkgrel=2
pkgdesc="Open-source Flutter client for MeshCore LoRa mesh networking devices."
groups=('meshcore')
arch=(
@@ -85,10 +85,12 @@
source=(
"${_pkgname}::git+https://${_githost}/${_gituser}/${_gitname}.git"
+ "flserial_once_flag_fix.patch::https://github.com/MeshEnvy/flserial/pull/1.patch"
"${_pkgname}.desktop"
)
sha256sums=(
'SKIP' # Main 'meshcore-open' source.
+ '0a870e4ca333c53457948cdc6cf31597f090a8291209314c9ac74660d8d8dc08' # 'flserial_once_flag_fix.patch'
'693903df45168de884191be566334fad4c5bd829b36f7e6c33440cf2efa79c5a' # '.desktop' file.
)
@@ -108,6 +110,22 @@
;;
esac
+
+_patch_only_if_not_applied() {
+ # Tries to apply a patch and if it already has been applied also return zero exit code.
+ # Arguments:
+ # $1: Patch file to apply.
+ # $2...: Other options to patch.
+ local _patch="$1"
+ shift
+ if ! patch --dry-run -R -i "${_patch}" "$@"; then
+ printf '%s\n' ' `-> Patch not yet applied, applying ...'
+ patch -i "${_patch}" "$@"
+ else
+ printf '%s\n' ' `-> Patch already applied.'
+ fi
+}
+
prepare() {
cd "${srcdir}/${_pkgname}"
export PUB_CACHE="${srcdir}/.pub_cache"
@@ -117,6 +135,14 @@
printf '%s\n' " --> downloading flutter/ dart dependencies ..."
flutter -v --disable-analytics
flutter -v pub get # --enforce-lockfile
+
+ # Patch this after downloading flutter dependencies -- since it patches a dependency:
+ local _patch='flserial_once_flag_fix.patch'
+ local _flserialdir
+ for _flserialdir in "${PUB_CACHE}/git"/flserial-[0-9a-f]*; do
+ printf '%s\n' " --> Applying patch '${_patch}' to '${_flserialdir}' ..."
+ _patch_only_if_not_applied "${srcdir}/${_patch}" -Np1 --follow-symlinks -d "${_flserialdir}"
+ done
#printf '%s\n' " --> size-optimising PNG images ..."
#find -name '*.png' -type f | parallel -j "${_nproc}" zopflipng -m -y {} {}

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 3
2026-09-16 00:03:17 Low 3
2026-09-15 00:25:31 Low 3
2026-09-14 00:27:57 Low 3
2026-09-13 00:19:54 Low 3
2026-09-12 00:25:17 Low 3
2026-09-11 00:19:22 Low 3
2026-09-10 00:22:44 Low 3
2026-09-09 00:04:09 Low 3
2026-09-08 00:18:08 Low 3
2026-09-07 00:30:15 Low 3
2026-09-06 23:12:41 Medium 2
2026-09-06 00:17:06 Low 3
2026-09-05 16:00:23 Medium 2
2026-09-05 00:16:27 Low 3
2026-09-04 00:03:13 Low 3
2026-09-03 00:15:47 Low 3
2026-09-02 00:02:31 Low 3
2026-09-01 00:11:19 Low 3
2026-08-31 00:19:57 Low 3

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion