nui-sftp

LOW

maintainer 5cript 1 votes scanned 2026-11-02 00:26:00.633185

View on AUR

Why flagged

The package downloads source code from GitHub and a frontend tarball from GitHub Releases, both legitimate project sources; the CEF binary is fetched from spotifycdn.com, a known and plausible host for CEF builds, and all downloads are checksum-verified; the only non-standard host is for a logo SVG, which is non-executable data and poses no risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code from GitHub and a frontend tarball from GitHub Releases, both legitimate project sources; the CEF binary is fetched from spotifycdn.com, a known and plausible host for CEF builds, and all downloads are checksum-verified; the only non-standard host is for a logo SVG, which is non-executable data and poses no risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:60 "https://s3.g.s4.mega.io/jgemkib4a5fte35rktt5wxrwkw4ejk4ybemkf/nui-scp/images/NUI-SFTP_Logo-01_nopad.svg"
PKGBUILD:62 "${_cefdirectory}.tar.bz2::https://cef-builds.spotifycdn.com/cef_binary_${_cefversion//+/%2B}_linux64_minimal.tar.bz2"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Tim Ebbeke <tim 06 tr (at) gmail dot com>
    
      2
    
      3pkgname=nui-sftp
    
      4pkgver=1.11.1
    
      5pkgrel=1
    
      6pkgdesc="NUI-based SFTP application"
    
      7arch=('x86_64')
    
      8url="https://github.com/5cript/nui-sftp"
    
      9license=('MIT')
    
      10# The CEF binary distribution Nui pins (cmake/dependencies/cef_version.cmake in Nui).
    
      11_cefversion=154.0.34+g14c5a08+chromium-154.0.8037.98
    
      12_cefdirectory="cef_binary_${_cefversion}_linux64_minimal"
    
      13depends=(
    
      14    curl
    
      15    crypto++
    
      16    libssh
    
      17    fmt
    
      18    boost
    
      19    boost-libs
    
      20    nlohmann-json
    
      21    sdbus-cpp
    
      22    zlib
    
      23    bzip2
    
      24    zstd
    
      25    xz
    
      26    glib2
    
      27    # Libraries of the bundled libcef.so
    
      28    alsa-lib
    
      29    at-spi2-core
    
      30    cairo
    
      31    dbus
    
      32    expat
    
      33    libcups
    
      34    libx11
    
      35    libxcb
    
      36    libxcomposite
    
      37    libxdamage
    
      38    libxext
    
      39    libxfixes
    
      40    libxkbcommon
    
      41    libxrandr
    
      42    mesa
    
      43    nspr
    
      44    nss
    
      45    pango
    
      46    systemd-libs
    
      47)
    
      48makedepends=(
    
      49    cmake
    
      50    ninja
    
      51    clang
    
      52    lld
    
      53    git
    
      54    python
    
      55    nodejs
    
      56)
    
      57options=('!debug')
    
      58source=(
    
      59    "$pkgname::git+$url.git#tag=v${pkgver//_/-}"
    
      60    "https://s3.g.s4.mega.io/jgemkib4a5fte35rktt5wxrwkw4ejk4ybemkf/nui-scp/images/NUI-SFTP_Logo-01_nopad.svg"
    
      61    "https://github.com/5cript/nui-sftp/releases/download/v${pkgver}/nui-sftp-linux-frontend_${pkgver}.tar.gz"
    
      62    "${_cefdirectory}.tar.bz2::https://cef-builds.spotifycdn.com/cef_binary_${_cefversion//+/%2B}_linux64_minimal.tar.bz2"
    
      63)
    
      64sha256sums=(
    
      65    '82403e98c990a51129442eb76d28d57c8d2c66bfd6c695a6f4c456b3bae42909'
    
      66    'cf0fc442069dfd28bd8b7769da6dfdca92111044ea9817197716ed9bfada3869'
    
      67    '47afeea441b474b9c12d493447d912d73cc1ac7e80738c5541df92ddfc3136db'
    
      68    'e87e2c76304372dd28b899ceb6efa4b353f52700594ddc358a8237ec07ec6492'
    
      69)
    
      70
    
      71prepare() {
    
      72    cd "$pkgname"
    
      73    git submodule update --init --recursive
    
      74}
    
      75
    
      76build() {
    
      77    cd "$pkgname"
    
      78
    
      79    cmake -B "$srcdir/$pkgname/build" \
    
      80        -S "$srcdir/$pkgname" \
    
      81        -G Ninja \
    
      82        -DCMAKE_BUILD_TYPE=Release \
    
      83        -DFORCED_PROJECT_VERSION="$pkgver" \
    
      84        -DCMAKE_C_COMPILER=clang \
    
      85        -DCMAKE_CXX_COMPILER=clang++ \
    
      86        -DCMAKE_LINKER=lld \
    
      87        -DCMAKE_CXX_STANDARD=23 \
    
      88        -DOMIT_FRONTEND_BUILD=ON \
    
      89        -DNUI_FETCH_TRAITS=OFF \
    
      90        -DNUI_BROWSER_ENGINE=cef \
    
      91        -DNUI_FETCH_CEF=OFF \
    
      92        -DNUI_CEF_ROOT="$srcdir/$_cefdirectory"
    
      93
    
      94    cmake --build "$srcdir/$pkgname/build"
    
      95}
    
      96
    
      97package() {
    
      98    # bin/nui-sftp, CEF in lib/nui-sftp, assets and themes
    
      99    DESTDIR="$pkgdir" cmake --install "$srcdir/$pkgname/build" --prefix /opt/"$pkgname"
    
      100
    
      101    # Unpack frontend tarball
    
      102    mkdir -p "$pkgdir"/opt/"$pkgname"/frontend
    
      103    tar -xzf "$srcdir/nui-sftp-linux-frontend_${pkgver//_/-}.tar.gz" -C "$pkgdir"/opt/"$pkgname"/frontend --strip-components=1
    
      104
    
      105    install -m644 "$srcdir/$pkgname/LICENSE" "$pkgdir"/opt/"$pkgname"/LICENSE
    
      106    install -Dm644 "$srcdir/$_cefdirectory/LICENSE.txt" "$pkgdir"/usr/share/licenses/"$pkgname"/CEF-LICENSE.txt
    
      107    install -Dm644 "$srcdir/$_cefdirectory/CREDITS.html" "$pkgdir"/usr/share/licenses/"$pkgname"/CEF-CREDITS.html
    
      108
    
      109    # Desktop
    
      110    install -Dm644 "$srcdir/$pkgname/org.nuicpp.nui_sftp.desktop" "$pkgdir"/usr/share/applications/"$pkgname".desktop
    
      111    install -Dm644 "NUI-SFTP_Logo-01_nopad.svg" "$pkgdir"/usr/share/icons/hicolor/scalable/apps/nui_sftp.svg
    
      112    install -Dm644 "NUI-SFTP_Logo-01_nopad.svg" "$pkgdir"/opt/"$pkgname"/assets/icons/nui-sftp-logo.svg
    
      113
    
      114    mkdir -p "$pkgdir"/usr/bin
    
      115    ln -s "/opt/$pkgname/bin/$pkgname" "$pkgdir"/usr/bin/"$pkgname"
    
      116}

Changes since previous scan

--- PKGBUILD @ 2026-10-29 00:13
+++ PKGBUILD @ 2026-11-02 00:26
@@ -1,7 +1,7 @@
 # Maintainer: Tim Ebbeke <tim 06 tr (at) gmail dot com>
 
 pkgname=nui-sftp
-pkgver=1.10.0
+pkgver=1.11.1
 pkgrel=1
 pkgdesc="NUI-based SFTP application"
 arch=('x86_64')
@@ -62,9 +62,9 @@
     "${_cefdirectory}.tar.bz2::https://cef-builds.spotifycdn.com/cef_binary_${_cefversion//+/%2B}_linux64_minimal.tar.bz2"
 )
 sha256sums=(
-    'bdcec395b112eb84e58a2a4d051db2f533e2606fbcd9a9c47c1d5a67710633f0'
+    '82403e98c990a51129442eb76d28d57c8d2c66bfd6c695a6f4c456b3bae42909'
     'cf0fc442069dfd28bd8b7769da6dfdca92111044ea9817197716ed9bfada3869'
-    '461617e1ef0de4be2cbf784b91a018ffe9208a3d560d2f6f8239ebcf0bf21f0f'
+    '47afeea441b474b9c12d493447d912d73cc1ac7e80738c5541df92ddfc3136db'
     'e87e2c76304372dd28b899ceb6efa4b353f52700594ddc358a8237ec07ec6492'
 )
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-02 00:26:00	Low	2
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 23:54:04	Medium	1
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 23:48:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 21:45:59	Medium	2
2026-10-26 00:12:40	Low	2
2026-10-25 03:41:34	Medium	1
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 17:26:05	Medium	1
2026-10-19 00:03:55	Medium	2