meteo-pl

LOW

maintainer kapiwko 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

Package builds from source hosted on the maintainer's GitHub, includes signed checksums for the primary source, and bundles a single dependency (valijson) from an untrusted host without verification; however, the bundled code is a header-only library used during build, posing low risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 90%): Package builds from source hosted on the maintainer's GitHub, includes signed checksums for the primary source, and bundles a single dependency (valijson) from an untrusted host without verification; however, the bundled code is a header-only library used during build, posing low risk.

PKGBUILD

      1# Maintainer: Kamil Piwowarski <kapiwko@gmail.com>
    
      2pkgname=meteo-pl
    
      3pkgver=0.9.2
    
      4pkgrel=1
    
      5pkgdesc='ICM weather forecasts, interactive meteograms and a Plasma 6 widget'
    
      6arch=('x86_64' 'aarch64')
    
      7url='https://github.com/kapiwko/meteo-pl'
    
      8license=('GPL-3.0-or-later')
    
      9depends=('glibc' 'libgcc' 'libstdc++' 'hicolor-icon-theme'
    
      10         'qt6-base' 'qt6-declarative' 'qt6-positioning' 'qt6-svg' 'qt6-wayland'
    
      11         'kirigami' 'ki18n' 'knotifications' 'kcolorscheme' 'kcoreaddons' 'qqc2-desktop-style'
    
      12         'breeze-icons' 'krunner')
    
      13makedepends=('cmake' 'ninja' 'gettext' 'extra-cmake-modules' 'python')
    
      14checkdepends=('xorg-server-xvfb' 'xorg-xauth' 'dbus' 'ttf-dejavu'
    
      15              'plasma-workspace' 'plasma-desktop')
    
      16optdepends=('plasma-desktop: Plasma widget and KRunner integration'
    
      17            'libplasma: Plasma widget runtime'
    
      18            'kcmutils: Plasma widget settings')
    
      19# Qt SVG, Wayland, desktop controls and icon themes are loaded at runtime.
    
      20# The AUR repository provides the source signing key under keys/pgp/.
    
      21source=("https://github.com/kapiwko/meteo-pl/releases/download/v${pkgver}/meteo-pl-${pkgver}.tar.gz"
    
      22        "meteo-pl-${pkgver}-SHA256SUMS::https://github.com/kapiwko/meteo-pl/releases/download/v${pkgver}/SHA256SUMS"
    
      23        "meteo-pl-${pkgver}-SHA256SUMS.asc::https://github.com/kapiwko/meteo-pl/releases/download/v${pkgver}/SHA256SUMS.asc"
    
      24        'valijson-5eac4b66.tar.gz::https://codeload.github.com/tristanpenman/valijson/tar.gz/5eac4b66f20b2c189ae40281c29e71cf39a958ec')
    
      25sha256sums=('d542b05a4ab2eb6adfece48f3d50ed26c9be00b37d6dfc00bdf5bddf0c623814'
    
      26            'c5ffe770b3f581177782705cf3a3848f61d7483ccea4640953c5a9c196968045'
    
      27            '56068c8369eca007aeb2b0a8d94aaba8ab0e249091121b1f80360ee79e386d93'
    
      28            '8b68741da04708c806d07a5a5fd181d3fb801aa161d7f65f45d7a3cc1b0c98ee')
    
      29validpgpkeys=('1C0C43EF3001F658C11971D1A4A884E5B7A2A8A1')
    
      30
    
      31prepare() {
    
      32    # makepkg verifies the maintainer signature on the checksum manifest.
    
      33    # Also bind the source archive to that signed manifest.
    
      34    cd "$srcdir"
    
      35    sha256sum --ignore-missing --check "meteo-pl-${pkgver}-SHA256SUMS"
    
      36}
    
      37
    
      38build() {
    
      39    cmake -S "$srcdir/meteo-pl-${pkgver}" -B build -G Ninja \
    
      40        -DCMAKE_BUILD_TYPE=None \
    
      41        -DCMAKE_INSTALL_PREFIX=/usr \
    
      42        -DBUILD_TESTING=ON \
    
      43        -DMETEO_BUILD_PLASMOID=ON \
    
      44        -DMETEO_BUILD_KRUNNER=ON \
    
      45        -DFETCHCONTENT_SOURCE_DIR_METEO_VALIJSON="$srcdir/valijson-5eac4b66f20b2c189ae40281c29e71cf39a958ec" \
    
      46        -DFETCHCONTENT_FULLY_DISCONNECTED=ON
    
      47    cmake --build build
    
      48}
    
      49
    
      50check() {
    
      51    dbus-run-session -- xvfb-run --auto-servernum ctest --test-dir build --output-on-failure
    
      52}
    
      53
    
      54package() {
    
      55    DESTDIR="$pkgdir" cmake --install build
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 23:59:16	Low	2