openbox-debian
LOW
maintainer TrialnError
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads the main source from the official project host and a Debian patch tarball from a non-whitelisted but plausible Debian mirror; the latter is used only for patching and not executed, posing minimal risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package downloads the main source from the official project host and a Debian patch tarball from a non-whitelisted but plausible Debian mirror; the latter is used only for patching and not executed, posing minimal risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:32
source=(http://openbox.org/dist/openbox/$_pkgname-$pkgver.tar.gz{,.asc} -
PKGBUILD:33
http://http.debian.net/debian/pool/main/o/openbox/openbox_3.6.1-12.debian.tar.xz)
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Dylan Araps <dylan.araps@gmail.com>
2
#
3
# Below are the maintainers and contributors of the official
4
# Arch package that this PKGBUILD is based on.
5
#
6
# Maintainer: Florian pritz <bluewind@xinu.at>
7
# Contributor: Bartłomiej Piotrowski <nospam@bpiotrowski.pl>
8
# Contributor: Brad Fanella <bradfanella@archlinux.us>
9
# Contributor: Andrea Scarpino <andrea@archlinux.org>
10
# Contributor: tobias <tobias@archlinux.org>
11
# Maintainer: Solomon Choina <shlomochoina@gmail.com
12
13
pkgname=openbox-debian
14
_pkgname=openbox
15
pkgver=3.6.1
16
pkgrel=4
17
pkgdesc='Highly configurable and lightweight X11 window manager with patches from Debian'
18
arch=('i686' 'x86_64')
19
url='http://openbox.org'
20
license=('GPL-2.0-only')
21
provides=(libobrender.so $_pkgname 'openbox')
22
conflicts=($_pkgname)
23
depends=('startup-notification' 'libxml2' 'libxinerama' 'libxrandr'
24
'libxcursor' 'pango' 'imlib2' 'librsvg' 'libsm')
25
makedepends=('python-pyxdg')
26
optdepends=('plasma-workspace: for the KDE/Openbox xsession'
27
'gnome-panel: for the openbox gnome session '
28
'python-pyxdg: for the openbox-xdg-autostart script')
29
groups=('lxde' 'lxde-gtk3' 'lxqt')
30
backup=('etc/xdg/openbox/menu.xml' 'etc/xdg/openbox/rc.xml'
31
'etc/xdg/openbox/autostart' 'etc/xdg/openbox/environment')
32
source=(http://openbox.org/dist/openbox/$_pkgname-$pkgver.tar.gz{,.asc}
33
http://http.debian.net/debian/pool/main/o/openbox/openbox_3.6.1-12.debian.tar.xz)
34
sha256sums=('8b4ac0760018c77c0044fab06a4f0c510ba87eae934d9983b10878483bde7ef7'
35
'SKIP'
36
'cf7c2fe6e9f31a46c2955d78ea8b301072742e954e16bc4d7f86b6b5cf312775')
37
validpgpkeys=(4B71379A9D5263D112A85620A5A4E99C711D3B61)
38
39
prepare() {
40
cd "${_pkgname}-${pkgver}"
41
42
local patches=(
43
01_rc.xml.patch
44
02_fix_freedesktop_compliance.patch
45
#03_place_windows_in_quadrants.patch
46
04_fix_xml_load_file.patch
47
05_openbox-3.5.0-title-matching.patch
48
06_openbox-3.5.0-which-2.20.patch
49
07_update_desktop.patch
50
08_autostart-fix.patch
51
09-disable-check-gnome-version.patch
52
1007147-openbox-imlib-free-image-NULL.patch
53
1033385_Fix_list_traversal_issue_in_client_calc_layer.patch
54
704724_fix_refers-to-autostart.sh.patch
55
719620_fix_show_startup_notification.patch
56
754207_use-scrot.patch
57
808138_Replace-getgrent-with-getgroups.patch
58
843231.patch
59
#873480_fix_restore-horz-vert.patch
60
887908.patch
61
917204_undecorated_maximized_no_border.patch
62
974180.patch
63
adapt-to-gsd-324.patch
64
Add-class-hint-to-focus-cycle-popup.patch
65
Allow-256x256-window-icon-size-for-HiDPI-displays.patch
66
d9a405e9.patch
67
de.po.patch
68
Fix-collision-between-iterator-and-throw-away-argume.patch
69
fix-spelling-error-in-binary.patch
70
python3.patch
71
)
72
73
for i in "${patches[@]}"; do
74
msg "Applying ${i} ..."
75
patch -p1 -i "../debian/patches/${i}"
76
done
77
78
# py3.patch modifies configure.ac
79
autoreconf -ifv
80
}
81
82
build() {
83
cd $_pkgname-$pkgver
84
./configure --prefix=/usr \
85
--with-x \
86
--enable-startup-notification \
87
--sysconfdir=/etc \
88
--libexecdir=/usr/lib/openbox
89
make
90
}
91
92
package() {
93
cd $_pkgname-$pkgver
94
make DESTDIR="$pkgdir" install
95
}
96
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |