notcurses-git

maintainer Ammonium · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package builds from the project's official GitHub repository, uses standard build practices, and the only issue is a skipped checksum, which is common for git sources; no malicious or high-risk behavior is present.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the project's official GitHub repository, uses standard build practices, and the only issue is a skipped checksum, which is common for git sources; no malicious or high-risk behavior is present.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer:  Vincent Grande <shoober420@gmail.com>
    
      2# Comaintainer: Nick Black <dankamongmen@gmail.com>
    
      3
    
      4pkgname=notcurses-git
    
      5pkgver=v3.0.17.r22.gb26048eeb
    
      6pkgrel=1
    
      7pkgdesc="Blingful TUI/character graphics library"
    
      8url="https://nick-black.com/dankwiki/index.php/Notcurses"
    
      9license=('Apache')
    
      10arch=('x86_64' 'aarch64')
    
      11# qrcodegen is currently shipped as a static archive on Arch, rather than a
    
      12# dynamic library. Should the .so be shipped in the future, promote qrcodegen
    
      13# from a makedepends to a true depends, and use that dynamic library.
    
      14depends=('ncurses' 'ffmpeg' 'libunistring')
    
      15provides=('notcurses=3.0.6')
    
      16conflicts=('notcurses')
    
      17source=("${pkgname}::git+https://github.com/dankamongmen/notcurses.git")
    
      18sha256sums=('SKIP')
    
      19
    
      20pkgver() {
    
      21  cd "${pkgname}"
    
      22  git describe --long | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      23}
    
      24
    
      25makedepends=('cmake' 'libdeflate' 'doctest' 'qrcodegen' 'ninja' 'gpm')
    
      26
    
      27prepare() {
    
      28  cd "${srcdir}/${pkgname}"
    
      29  cmake -S . -B build -GNinja -DCMAKE_INSTALL_PREFIX="/usr" -DCMAKE_BUILD_TYPE=RelWithDebInfo -DUSE_QRCODEGEN=on -DUSE_GPM=on -DUSE_PANDOC=off
    
      30}
    
      31
    
      32build() {
    
      33  cd "${srcdir}/${pkgname}"
    
      34  cmake --build build
    
      35}
    
      36
    
      37package() {
    
      38  cd "${srcdir}/${pkgname}/build"
    
      39  DESTDIR="$pkgdir" ninja install
    
      40  cd -
    
      41	for i in 1 3 ; do
    
      42		find "$srcdir" -maxdepth 1 -type f -iname \*.$i -exec echo "$pkgdir"/usr/share/man/man$i {} \;
    
      43		find "$srcdir" -maxdepth 1 -type f -iname \*.$i -exec install -Dm644 -t "$pkgdir"/usr/share/man/man$i {} \;
    
      44	done
    
      45}
    
      46

Changes since previous scan

--- PKGBUILD @ 2026-08-14 07:28
+++ PKGBUILD @ 2026-08-18 00:03
@@ -2,7 +2,7 @@
 # Comaintainer: Nick Black <dankamongmen@gmail.com>
 
 pkgname=notcurses-git
-pkgver=v3.0.16.r6.ge6aeee519
+pkgver=v3.0.17.r22.gb26048eeb
 pkgrel=1
 pkgdesc="Blingful TUI/character graphics library"
 url="https://nick-black.com/dankwiki/index.php/Notcurses"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 19:29:30	MEDIUM	1
2026-08-14 07:28:04	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0