owlry

LOW

maintainer vikingowl 3 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The source is fetched from a project-owned git host not on the whitelist, but it is the project's own source code being built, which is normal for AUR packages.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is fetched from a project-owned git host not on the whitelist, but it is the project's own source code being built, which is normal for AUR packages.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:91 source=("$pkgname-$pkgver.tar.gz::https://somegit.dev/Owlibou/owlry/archive/owlry-v$pkgver.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: vikingowl <christian@nachtigall.dev>
    
      2pkgname=owlry
    
      3pkgver=2.8.0
    
      4pkgrel=1
    
      5pkgdesc="Lightweight Wayland application launcher — UI, daemon, and providers in one binary"
    
      6arch=('x86_64')
    
      7url="https://somegit.dev/Owlibou/owlry"
    
      8license=('GPL-3.0-or-later')
    
      9depends=(
    
      10    'gcc-libs'
    
      11    'gtk4'
    
      12    'gtk4-layer-shell'
    
      13)
    
      14makedepends=('cargo')
    
      15optdepends=(
    
      16    'cliphist: clipboard history provider'
    
      17    'wl-clipboard: clipboard write and emoji copy'
    
      18    'rofimoji: emoji, kaomoji, and Unicode character picker'
    
      19    'xdotool: optional X11 rofimoji typer'
    
      20    'wtype: optional Wayland rofimoji typer'
    
      21    'ydotool: optional fallback Wayland rofimoji typer'
    
      22    'wl-ime-type: optional Wayland IME rofimoji typer'
    
      23    'fd: filesystem search provider (primary backend)'
    
      24    'plocate: filesystem search provider (fallback backend)'
    
      25)
    
      26# v2.0 replaces the entire pre-collapse package set. paru/pacman -Syu
    
      27# transparently swaps the old packages for owlry-2.0.0 via these arrays.
    
      28# Notes:
    
      29#   - owlry-{core,lua,rune}: functionality merged into owlry; Lua runtime
    
      30#     deferred to a later release with the Lua config layer (D4 / Phase 3).
    
      31#   - owlry-plugin-*: every plugin became a feature-gated module in owlry.
    
      32#     This PKGBUILD builds with --features full so all of them are present.
    
      33#   - owlry-plugin-{weather,media,pomodoro}: widgets are deferred per D20.
    
      34#     Listed here so users on those packages get a clean upgrade; widget
    
      35#     functionality returns in a later 2.x release.
    
      36#   - owlry-plugin-scripts: replaced by user Lua config (D12), Phase 3+.
    
      37#   - owlry-meta-*: superseded by the single owlry package.
    
      38_v2_retired=(
    
      39    'owlry-core'
    
      40    'owlry-lua'
    
      41    'owlry-rune'
    
      42    # Plugins folded into owlry as feature-gated modules.
    
      43    'owlry-plugin-clipboard'
    
      44    'owlry-plugin-emoji'
    
      45    'owlry-plugin-filesearch'
    
      46    'owlry-plugin-ssh'
    
      47    'owlry-plugin-systemd'
    
      48    'owlry-plugin-websearch'
    
      49    # Deferred providers (D20+); package replaced so users get a clean
    
      50    # transition. Functionality returns in a later 2.x release.
    
      51    'owlry-plugin-bookmarks'
    
      52    'owlry-plugin-media'
    
      53    'owlry-plugin-pomodoro'
    
      54    'owlry-plugin-weather'
    
      55    # Replaced by user Lua config (D12), Phase 3+.
    
      56    'owlry-plugin-scripts'
    
      57    # Pre-v2 transitional stubs (pkgrel -99) where calc/conv/power were
    
      58    # already folded into owlry-core. Listed so any straggler installs
    
      59    # are swept up by the v2 upgrade.
    
      60    'owlry-plugin-calculator'
    
      61    'owlry-plugin-converter'
    
      62    'owlry-plugin-system'
    
      63    # Meta-bundles superseded by the single owlry package.
    
      64    'owlry-meta-essentials'
    
      65    'owlry-meta-widgets'
    
      66    'owlry-meta-tools'
    
      67    'owlry-meta-full'
    
      68)
    
      69replaces=("${_v2_retired[@]}")
    
      70conflicts=("${_v2_retired[@]}")
    
      71
    
      72# Only claim packages whose functionality is present in this build. The
    
      73# remaining retired packages above stay in replaces/conflicts solely so
    
      74# upgrades from the pre-v2 package split remain automatic.
    
      75provides=(
    
      76    'owlry-core'
    
      77    'owlry-lua'
    
      78    'owlry-plugin-clipboard'
    
      79    'owlry-plugin-emoji'
    
      80    'owlry-plugin-filesearch'
    
      81    'owlry-plugin-ssh'
    
      82    'owlry-plugin-systemd'
    
      83    'owlry-plugin-websearch'
    
      84    'owlry-plugin-calculator'
    
      85    'owlry-plugin-converter'
    
      86    'owlry-plugin-system'
    
      87)
    
      88
    
      89install=owlry.install
    
      90
    
      91source=("$pkgname-$pkgver.tar.gz::https://somegit.dev/Owlibou/owlry/archive/owlry-v$pkgver.tar.gz")
    
      92b2sums=('d63a839961eeade28a782ee05e68059d9c373d56f15a1dc9591168458ba0a072f965d1e78d325914038b859ba2ceec18431726350cb02a4cc08289a27cd28ccb')
    
      93
    
      94prepare() {
    
      95    cd "owlry"
    
      96    export RUSTUP_TOOLCHAIN=stable
    
      97    cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      98}
    
      99
    
      100build() {
    
      101    cd "owlry"
    
      102    export RUSTUP_TOOLCHAIN=stable
    
      103    export CARGO_TARGET_DIR=target
    
      104    # Force GNU ld.bfd. Arch's `extra/rust` defaults rustc to `-fuse-ld=lld`,
    
      105    # and LLD's single-pass arg processing can't satisfy `-llua5.4` because
    
      106    # mlua-sys+lua-src emit the `-l` flag before their `-L $OUT_DIR/lib`
    
      107    # search path in the final link line (cargo:rustc-link-lib emitted
    
      108    # before cargo:rustc-link-search). BFD does multi-pass and finds the
    
      109    # archive regardless. RUSTFLAGS env-var beats any cargo config rustflags,
    
      110    # which is necessary here because Arch's rust pkg appears to set its own
    
      111    # RUSTFLAGS that we need to fully override.
    
      112    export RUSTFLAGS="-C link-arg=-fuse-ld=bfd"
    
      113    # 'full' enables every optional provider — the AUR binary is the
    
      114    # batteries-included experience. cargo install consumers can still opt
    
      115    # to --no-default-features and pick their own subset.
    
      116    cargo build --frozen --release --features full
    
      117}
    
      118
    
      119check() {
    
      120    cd "owlry"
    
      121    export RUSTUP_TOOLCHAIN=stable
    
      122    export CARGO_TARGET_DIR=target
    
      123    export RUSTFLAGS="-C link-arg=-fuse-ld=bfd"
    
      124    cargo test --frozen --release --features full
    
      125}
    
      126
    
      127package() {
    
      128    cd "owlry"
    
      129
    
      130    # Single binary.
    
      131    install -Dm755 "target/release/$pkgname" "$pkgdir/usr/bin/$pkgname"
    
      132
    
      133    # systemd user units (renamed from owlryd.* in v2 — see D15).
    
      134    install -Dm644 systemd/owlry.service "$pkgdir/usr/lib/systemd/user/owlry.service"
    
      135    install -Dm644 systemd/owlry.socket "$pkgdir/usr/lib/systemd/user/owlry.socket"
    
      136
    
      137    # Documentation + example configuration.
    
      138    install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      139    install -Dm644 data/owlry.example.lua "$pkgdir/usr/share/doc/$pkgname/owlry.example.lua"
    
      140    install -Dm644 data/config.example.toml "$pkgdir/usr/share/doc/$pkgname/config.example.toml"
    
      141    install -Dm644 data/style.example.css "$pkgdir/usr/share/doc/$pkgname/style.example.css"
    
      142
    
      143    # Man page.
    
      144    install -Dm644 data/owlry.1 "$pkgdir/usr/share/man/man1/owlry.1"
    
      145
    
      146    # Themes.
    
      147    install -d "$pkgdir/usr/share/$pkgname/themes"
    
      148    install -Dm644 data/themes/*.css "$pkgdir/usr/share/$pkgname/themes/"
    
      149}
    
      150

Changes since previous scan

--- PKGBUILD @ 2026-10-28 00:06
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,6 +1,6 @@
 # Maintainer: vikingowl <christian@nachtigall.dev>
 pkgname=owlry
-pkgver=2.7.0
+pkgver=2.8.0
 pkgrel=1
 pkgdesc="Lightweight Wayland application launcher — UI, daemon, and providers in one binary"
 arch=('x86_64')
@@ -89,7 +89,7 @@
 install=owlry.install
 
 source=("$pkgname-$pkgver.tar.gz::https://somegit.dev/Owlibou/owlry/archive/owlry-v$pkgver.tar.gz")
-b2sums=('369d1e5beb847b5b755e251b2b4ee834554a0547c0c2bfcbe40dfc84f48e9f3b9c807d8fdce9c7064e9673a84df3c2cbe0773cca9e41e0a4964ab6b48d0efdeb')
+b2sums=('d63a839961eeade28a782ee05e68059d9c373d56f15a1dc9591168458ba0a072f965d1e78d325914038b859ba2ceec18431726350cb02a4cc08289a27cd28ccb')
 
 prepare() {
     cd "owlry"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 11:50:06	Medium	1
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2