nted

maintainer yochananmarqos · 1 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The non-standard host (vsr.informatik.tu-chemnitz.de) is the project's own official university server as referenced in the package URL, and all sources including Debian patches from salsa.debian.org have verified sha256sums; this is normal AUR packaging of an open-source project.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The non-standard host (vsr.informatik.tu-chemnitz.de) is the project's own official university server as referenced in the package URL, and all sources including Debian patches from salsa.debian.org have verified sha256sums; this is normal AUR packaging of an open-source project.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:39 source=("https://vsr.informatik.tu-chemnitz.de/staff/jan/nted/sources/$pkgbase-$pkgver.tar.gz"

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mark Wagie <mark dot wagie at proton dot me>
    
      2# Contributor: Sergej Pupykin <pupykin.s+arch@gmail.com>
    
      3# Contributor: Wael Nasreddine <gandalf@siemens-mobiles.org>
    
      4# Contributor: Stefan Husmann <stefan-husmann@t-online.de>
    
      5pkgname=(
    
      6  'nted'
    
      7  'nted-docs'
    
      8)
    
      9pkgbase=nted
    
      10pkgver=1.10.18
    
      11pkgrel=8
    
      12_deb_rel=13.1
    
      13pkgdesc="Musical score editor"
    
      14arch=('x86_64')
    
      15url="https://vsr.informatik.tu-chemnitz.de/staff/jan/nted/nted.xhtml"
    
      16license=('GPL-2.0-or-later')
    
      17depends=(
    
      18  'alsa-lib'
    
      19  'cairo'
    
      20  'freetype2'
    
      21  'gdk-pixbuf2'
    
      22  'glib2'
    
      23  'glibc'
    
      24  'gtk3'
    
      25  'libgcc'
    
      26  'libstdc++'
    
      27  'libx11'
    
      28  'pango'
    
      29)
    
      30makedepends=(
    
      31  'desktop-file-utils'
    
      32  'docbook-xml'  ## docs
    
      33  'docbook-xsl'  ## docs
    
      34  'poxml'  ## docs
    
      35  'xmlto'  ## docs
    
      36  'yelp'  ## docs
    
      37)
    
      38_deb_url="https://salsa.debian.org/debian/nted/-/raw/debian/$pkgver-${_deb_rel}/debian/patches"
    
      39source=("https://vsr.informatik.tu-chemnitz.de/staff/jan/nted/sources/$pkgbase-$pkgver.tar.gz"
    
      40        "${_deb_url}/gtk3.patch"
    
      41        "${_deb_url}/automake.patch"
    
      42        "${_deb_url}/remove-encoding-key-in-desktop-file"
    
      43        "${_deb_url}/linking"
    
      44        "${_deb_url}/doc-requirements"
    
      45        "${_deb_url}/empty_page_reposit.patch"
    
      46        "${_deb_url}/fix-empty-captions.patch"
    
      47        "${_deb_url}/g++-4.7.patch"
    
      48        "${_deb_url}/Werror.patch"
    
      49        "${_deb_url}/fix-midi-import.patch"
    
      50        "${_deb_url}/fix-signage-of-char-arrays.patch"
    
      51        "${_deb_url}/series"
    
      52)
    
      53sha256sums=('808df3c851dbc4b24efdbf96c4e6ed28152deb301c4373268831f2a243e8f1ac'
    
      54            'a0381a01348e9a09e43958cd7d57a138828cfd60e0b12bcb2c0b6771cca3e580'
    
      55            '2d6494363edd25c70aa596f1c098cb428572e8edf90c625abd445add6f9b6dd2'
    
      56            '4ec9fab668621c6cd0a34a04b1ad988ea6fd592e20cbbfe2156379341cd6a009'
    
      57            '727502f1d44179d68028c048960d1ed85586ef843601c9e0ef4f6ff52ca60248'
    
      58            'c23727c130055ec1fde9d961917422e867fd944eca204a6be140e3ef59f53ff5'
    
      59            '5cb47e4e5c7310f26d41e8cc6a5f0cd51dffa65d6f545afcea8b6474d16f567d'
    
      60            'e897fc06cd0dbd5372473f06638257e9f009df08a2dfe4e8448655f544e52f39'
    
      61            '9f5626f15f58627d70f4eb67228d41a230526463b87df979e40166df38d0567d'
    
      62            'd3966f610a68335ddaabdf7188ac67ea3ff028074aeacdffeb4a0183ebe517b0'
    
      63            '63ab3ae361c575ec78feda32f728b3d5e872f643514eae37d549416a83d1f709'
    
      64            '86ad2b6290ca59ba53521868107b458117a9c2cf79e1aea4e5b8a616300545ff'
    
      65            '622599ba493ef7849ca324d01aee39f7595fb5182184f340cb70634f370717e2')
    
      66
    
      67prepare() {
    
      68  cd $pkgbase-$pkgver
    
      69
    
      70  # Debian patches
    
      71  while IFS= read -r patch; do
    
      72    patch -Np1 -i "$srcdir/${patch}"
    
      73  done < "$srcdir/series"
    
      74
    
      75  mv -f configure.in configure.ac
    
      76
    
      77  # Fix icon & remove deprecated category
    
      78  desktop-file-edit --set-icon="$pkgbase" --remove-category=Application \
    
      79    "datafiles/applications/$pkgbase.desktop"
    
      80}
    
      81
    
      82build() {
    
      83  cd "$pkgbase-$pkgver"
    
      84  aclocal
    
      85  automake --add-missing
    
      86  autoreconf
    
      87  ./configure --prefix=/usr
    
      88  make
    
      89}
    
      90
    
      91check() {
    
      92  cd "$pkgbase-$pkgver"
    
      93  desktop-file-validate "datafiles/applications/$pkgname.desktop"
    
      94}
    
      95
    
      96package_nted () {
    
      97  pushd "$pkgbase-$pkgver"
    
      98  make DESTDIR="$pkgdir" install
    
      99  popd
    
      100
    
      101  mkdir -p doc/usr/share
    
      102  mv {"$pkgdir",doc}/usr/share/doc/
    
      103}
    
      104
    
      105package_nted-docs () {
    
      106  pkgdesc+=" (HTML Documentation)"
    
      107  depends=()
    
      108
    
      109  mv doc/* "$pkgdir/"
    
      110}
    
      111

Changes since previous scan

--- PKGBUILD @ 2026-06-20 00:18
+++ PKGBUILD @ 2026-08-18 00:03
@@ -1,43 +1,111 @@
+# Maintainer: Mark Wagie <mark dot wagie at proton dot me>
 # Contributor: Sergej Pupykin <pupykin.s+arch@gmail.com>
 # Contributor: Wael Nasreddine <gandalf@siemens-mobiles.org>
-# Maintainer: Stefan Husmann <stefan-husmann@t-online.de>
-
-pkgname=nted
+# Contributor: Stefan Husmann <stefan-husmann@t-online.de>
+pkgname=(
+  'nted'
+  'nted-docs'
+)
+pkgbase=nted
 pkgver=1.10.18
-pkgrel=7
-pkgdesc="A free music score editor for Linux."
-arch=('i686' 'x86_64')
-depends=('harfbuzz' 'gdk-pixbuf2' 'pango' 'gtk2' 'alsa-lib')
-makedepends=()
-license=('GPL')
-url="http://http.debian.net/debian/pool/main/n/nted/"
-options=('!libtool' '!strip' '!makeflags')
-source=("http://deb.debian.org/debian/pool/main/n/$pkgname/${pkgname}_$pkgver.orig.tar.gz"
-	"http://http.debian.net/debian/pool/main/n/$pkgname/${pkgname}_$pkgver-13.debian.tar.xz")
+pkgrel=8
+_deb_rel=13.1
+pkgdesc="Musical score editor"
+arch=('x86_64')
+url="https://vsr.informatik.tu-chemnitz.de/staff/jan/nted/nted.xhtml"
+license=('GPL-2.0-or-later')
+depends=(
+  'alsa-lib'
+  'cairo'
+  'freetype2'
+  'gdk-pixbuf2'
+  'glib2'
+  'glibc'
+  'gtk3'
+  'libgcc'
+  'libstdc++'
+  'libx11'
+  'pango'
+)
+makedepends=(
+  'desktop-file-utils'
+  'docbook-xml'  ## docs
+  'docbook-xsl'  ## docs
+  'poxml'  ## docs
+  'xmlto'  ## docs
+  'yelp'  ## docs
+)
+_deb_url="https://salsa.debian.org/debian/nted/-/raw/debian/$pkgver-${_deb_rel}/debian/patches"
+source=("https://vsr.informatik.tu-chemnitz.de/staff/jan/nted/sources/$pkgbase-$pkgver.tar.gz"
+        "${_deb_url}/gtk3.patch"
+        "${_deb_url}/automake.patch"
+        "${_deb_url}/remove-encoding-key-in-desktop-file"
+        "${_deb_url}/linking"
+        "${_deb_url}/doc-requirements"
+        "${_deb_url}/empty_page_reposit.patch"
+        "${_deb_url}/fix-empty-captions.patch"
+        "${_deb_url}/g++-4.7.patch"
+        "${_deb_url}/Werror.patch"
+        "${_deb_url}/fix-midi-import.patch"
+        "${_deb_url}/fix-signage-of-char-arrays.patch"
+        "${_deb_url}/series"
+)
 sha256sums=('808df3c851dbc4b24efdbf96c4e6ed28152deb301c4373268831f2a243e8f1ac'
-            'c9e6bc6e213641cd4f08964b36e2192c2ec6710d473088e2d1d4fc9e8e34108f')
+            'a0381a01348e9a09e43958cd7d57a138828cfd60e0b12bcb2c0b6771cca3e580'
+            '2d6494363edd25c70aa596f1c098cb428572e8edf90c625abd445add6f9b6dd2'
+            '4ec9fab668621c6cd0a34a04b1ad988ea6fd592e20cbbfe2156379341cd6a009'
+            '727502f1d44179d68028c048960d1ed85586ef843601c9e0ef4f6ff52ca60248'
+            'c23727c130055ec1fde9d961917422e867fd944eca204a6be140e3ef59f53ff5'
+            '5cb47e4e5c7310f26d41e8cc6a5f0cd51dffa65d6f545afcea8b6474d16f567d'
+            'e897fc06cd0dbd5372473f06638257e9f009df08a2dfe4e8448655f544e52f39'
+            '9f5626f15f58627d70f4eb67228d41a230526463b87df979e40166df38d0567d'
+            'd3966f610a68335ddaabdf7188ac67ea3ff028074aeacdffeb4a0183ebe517b0'
+            '63ab3ae361c575ec78feda32f728b3d5e872f643514eae37d549416a83d1f709'
+            '86ad2b6290ca59ba53521868107b458117a9c2cf79e1aea4e5b8a616300545ff'
+            '622599ba493ef7849ca324d01aee39f7595fb5182184f340cb70634f370717e2')
 
 prepare() {
-  cd $pkgname-$pkgver
-  
-  for i in `cat "$srcdir"/debian/patches/series`
-  do
-    patch -p1 < "$srcdir"/debian/patches/$i || true
-  done
-  mv configure.in configure.ac
+  cd $pkgbase-$pkgver
+
+  # Debian patches
+  while IFS= read -r patch; do
+    patch -Np1 -i "$srcdir/${patch}"
+  done < "$srcdir/series"
+
+  mv -f configure.in configure.ac
+
+  # Fix icon & remove deprecated category
+  desktop-file-edit --set-icon="$pkgbase" --remove-category=Application \
+    "datafiles/applications/$pkgbase.desktop"
 }
 
 build() {
-  cd $pkgname-$pkgver
+  cd "$pkgbase-$pkgver"
   aclocal
   automake --add-missing
   autoreconf
-  CXXFLAGS=" -O2 -std=c++11 -Wno-narrowing" ./configure --prefix=/usr 
+  ./configure --prefix=/usr
   make
 }
 
-package() {
-  cd $pkgname-$pkgver
-  make DESTDIR="$pkgdir" install
+check() {
+  cd "$pkgbase-$pkgver"
+  desktop-file-validate "datafiles/applications/$pkgname.desktop"
 }
 
+package_nted () {
+  pushd "$pkgbase-$pkgver"
+  make DESTDIR="$pkgdir" install
+  popd
+
+  mkdir -p doc/usr/share
+  mv {"$pkgdir",doc}/usr/share/doc/
+}
+
+package_nted-docs () {
+  pkgdesc+=" (HTML Documentation)"
+  depends=()
+
+  mv doc/* "$pkgdir/"
+}
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	3
2026-08-17 00:18:29	LOW	3
2026-08-16 00:03:42	LOW	3
2026-08-15 00:26:13	LOW	3
2026-08-14 00:03:41	LOW	3
2026-08-13 00:17:07	LOW	3
2026-08-12 00:27:08	LOW	3
2026-08-11 23:21:47	MEDIUM	2
2026-06-20 00:18:46	CLEAN	2
2026-06-19 23:51:18	CLEAN	2
2026-06-19 19:07:35	LOW	2
2026-06-18 16:11:54	MEDIUM	1