minnow-bin

MEDIUM

maintainer Voten 0 votes scanned 2026-10-25 21:43:05.033624

View on AUR

Why flagged

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("$pkgname-$pkgver.tar.gz::https://forgejo.voten.me/Voten641/minnow/releases/download/v$pkgver/minnow-v$pkgver-x86_64.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Minnow Contributors <noreply@example.com>
    
      2pkgname=minnow-bin
    
      3pkgver=1.2.0
    
      4pkgrel=1
    
      5pkgdesc="A simple, lightweight file manager for KDE (prebuilt binary)"
    
      6arch=('x86_64')
    
      7url="https://forgejo.voten.me/Voten641/minnow"
    
      8license=('GPL-3.0-or-later')
    
      9depends=('qt6-base' 'kcoreaddons' 'kconfigwidgets' 'kwidgetsaddons' 'kio' 'kfilemetadata' 'karchive' 'knotifications' 'kwindowsystem')
    
      10provides=('minnow')
    
      11conflicts=('minnow')
    
      12# grabs the tarball built by the Forgejo release-binary workflow (archlinux:latest container, so ABI matches)
    
      13source=("$pkgname-$pkgver.tar.gz::https://forgejo.voten.me/Voten641/minnow/releases/download/v$pkgver/minnow-v$pkgver-x86_64.tar.gz")
    
      14sha256sums=('b55e4ab2538dc721b6ca886155d374317099b879e7a73482c3edc6df9135a45c')
    
      15
    
      16package() {
    
      17  cp -a "$srcdir/usr" "$pkgdir/"
    
      18}
    
      19

Changes since previous scan

--- PKGBUILD @ 2026-09-23 09:40
+++ PKGBUILD @ 2026-10-25 21:43
@@ -1,17 +1,17 @@
 # Maintainer: Minnow Contributors <noreply@example.com>
 pkgname=minnow-bin
-pkgver=0.1.9
+pkgver=1.2.0
 pkgrel=1
 pkgdesc="A simple, lightweight file manager for KDE (prebuilt binary)"
 arch=('x86_64')
-url="https://github.com/minnowfm/minnow"
+url="https://forgejo.voten.me/Voten641/minnow"
 license=('GPL-3.0-or-later')
 depends=('qt6-base' 'kcoreaddons' 'kconfigwidgets' 'kwidgetsaddons' 'kio' 'kfilemetadata' 'karchive' 'knotifications' 'kwindowsystem')
 provides=('minnow')
 conflicts=('minnow')
-# grabs the tarball built by the release workflow (archlinux:latest container, so ABI matches)
-source=("$pkgname-$pkgver.tar.gz::https://github.com/minnowfm/minnow/releases/download/v$pkgver/minnow-v$pkgver-x86_64.tar.gz")
-sha256sums=('4700fd92b452952345d9dd8f5a2d3a95037ca01c69e50954ba51d176da94c9e4')
+# grabs the tarball built by the Forgejo release-binary workflow (archlinux:latest container, so ABI matches)
+source=("$pkgname-$pkgver.tar.gz::https://forgejo.voten.me/Voten641/minnow/releases/download/v$pkgver/minnow-v$pkgver-x86_64.tar.gz")
+sha256sums=('b55e4ab2538dc721b6ca886155d374317099b879e7a73482c3edc6df9135a45c')
 
 package() {
   cp -a "$srcdir/usr" "$pkgdir/"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-25 21:43:05	Medium	1
2026-09-23 09:40:25	Clean	0
2026-09-14 19:17:46	Clean	0
2026-09-13 11:14:35	Clean	0
2026-08-11 21:21:47	Clean	0
2026-08-02 00:16:08	Clean	2
2026-08-01 11:20:22	Low	1
2026-08-01 00:11:18	Low	2
2026-07-31 21:18:45	Low	2
2026-07-30 00:17:23	Clean	2
2026-07-29 11:11:22	Low	1
2026-07-29 09:11:06	Low	1
2026-07-29 00:25:53	Low	2
2026-07-28 00:07:28	Low	2
2026-07-27 00:24:32	Low	2
2026-07-26 15:32:35	Low	2
2026-07-26 00:07:32	Low	2
2026-07-25 00:13:44	Low	2
2026-07-24 21:28:26	Low	2
2026-07-24 19:28:12	Low	2