owlry

maintainer vikingowl · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a tarball from the project's own Git host (somegit.dev/Owlibou/owlry), which is plausibly the official project infrastructure; building from such a source is normal for AUR packages and does not constitute a supply-chain risk, even if the domain is not on a standard whitelist.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the project's own Git host (somegit.dev/Owlibou/owlry), which is plausibly the official project infrastructure; building from such a source is normal for AUR packages and does not constitute a supply-chain risk, even if the domain is not on a standard whitelist.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:76 source=("$pkgname-$pkgver.tar.gz::https://somegit.dev/Owlibou/owlry/archive/owlry-v$pkgver.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: vikingowl <christian@nachtigall.dev>
    
      2pkgname=owlry
    
      3pkgver=2.4.0
    
      4pkgrel=1
    
      5pkgdesc="Lightweight Wayland application launcher — UI, daemon, and providers in one binary"
    
      6arch=('x86_64')
    
      7url="https://somegit.dev/Owlibou/owlry"
    
      8license=('GPL-3.0-or-later')
    
      9depends=(
    
      10    'gcc-libs'
    
      11    'gtk4'
    
      12    'gtk4-layer-shell'
    
      13)
    
      14makedepends=('cargo')
    
      15optdepends=(
    
      16    'cliphist: clipboard history provider'
    
      17    'wl-clipboard: clipboard write and emoji copy'
    
      18    'fd: filesystem search provider (primary backend)'
    
      19    'mlocate: filesystem search provider (fallback backend)'
    
      20)
    
      21# v2.0 replaces the entire pre-collapse package set. paru/pacman -Syu
    
      22# transparently swaps the old packages for owlry-2.0.0 via these arrays.
    
      23# Notes:
    
      24#   - owlry-{core,lua,rune}: functionality merged into owlry; Lua runtime
    
      25#     deferred to a later release with the Lua config layer (D4 / Phase 3).
    
      26#   - owlry-plugin-*: every plugin became a feature-gated module in owlry.
    
      27#     This PKGBUILD builds with --features full so all of them are present.
    
      28#   - owlry-plugin-{weather,media,pomodoro}: widgets are deferred per D20.
    
      29#     Listed here so users on those packages get a clean upgrade; widget
    
      30#     functionality returns in a later 2.x release.
    
      31#   - owlry-plugin-scripts: replaced by user Lua config (D12), Phase 3+.
    
      32#   - owlry-meta-*: superseded by the single owlry package.
    
      33_v2_replaced=(
    
      34    'owlry-core'
    
      35    'owlry-lua'
    
      36    'owlry-rune'
    
      37    # Plugins folded into owlry as feature-gated modules.
    
      38    'owlry-plugin-clipboard'
    
      39    'owlry-plugin-emoji'
    
      40    'owlry-plugin-filesearch'
    
      41    'owlry-plugin-ssh'
    
      42    'owlry-plugin-systemd'
    
      43    'owlry-plugin-websearch'
    
      44    # Deferred providers (D20+); package replaced so users get a clean
    
      45    # transition. Functionality returns in a later 2.x release.
    
      46    'owlry-plugin-bookmarks'
    
      47    'owlry-plugin-media'
    
      48    'owlry-plugin-pomodoro'
    
      49    'owlry-plugin-weather'
    
      50    # Replaced by user Lua config (D12), Phase 3+.
    
      51    'owlry-plugin-scripts'
    
      52    # Pre-v2 transitional stubs (pkgrel -99) where calc/conv/power were
    
      53    # already folded into owlry-core. Listed so any straggler installs
    
      54    # are swept up by the v2 upgrade.
    
      55    'owlry-plugin-calculator'
    
      56    'owlry-plugin-converter'
    
      57    'owlry-plugin-system'
    
      58    # Meta-bundles superseded by the single owlry package.
    
      59    'owlry-meta-essentials'
    
      60    'owlry-meta-widgets'
    
      61    'owlry-meta-tools'
    
      62    'owlry-meta-full'
    
      63)
    
      64replaces=("${_v2_replaced[@]}")
    
      65conflicts=("${_v2_replaced[@]}")
    
      66provides=("${_v2_replaced[@]}")
    
      67
    
      68install=owlry.install
    
      69
    
      70# Cargo's release profile strips the binary at compile time (strip = true
    
      71# in workspace Cargo.toml), so there are no debug symbols left for makepkg
    
      72# to extract into an owlry-debug subpackage. Disable debug splitting so the
    
      73# build doesn't ship a 0-byte debug package.
    
      74options=('!debug')
    
      75
    
      76source=("$pkgname-$pkgver.tar.gz::https://somegit.dev/Owlibou/owlry/archive/owlry-v$pkgver.tar.gz")
    
      77b2sums=('9ba4b88bf51d86971a4ef78fb9be8504632adcb1e1b34b4e0f478b61cfde66c7fd15b3a2c1645439143cdd539eb20cc725fafee0893ed2a77d7f7e15f93269da')
    
      78
    
      79prepare() {
    
      80    cd "owlry"
    
      81    export RUSTUP_TOOLCHAIN=stable
    
      82    cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      83}
    
      84
    
      85build() {
    
      86    cd "owlry"
    
      87    export RUSTUP_TOOLCHAIN=stable
    
      88    export CARGO_TARGET_DIR=target
    
      89    # Force GNU ld.bfd. Arch's `extra/rust` defaults rustc to `-fuse-ld=lld`,
    
      90    # and LLD's single-pass arg processing can't satisfy `-llua5.4` because
    
      91    # mlua-sys+lua-src emit the `-l` flag before their `-L $OUT_DIR/lib`
    
      92    # search path in the final link line (cargo:rustc-link-lib emitted
    
      93    # before cargo:rustc-link-search). BFD does multi-pass and finds the
    
      94    # archive regardless. RUSTFLAGS env-var beats any cargo config rustflags,
    
      95    # which is necessary here because Arch's rust pkg appears to set its own
    
      96    # RUSTFLAGS that we need to fully override.
    
      97    export RUSTFLAGS="-C link-arg=-fuse-ld=bfd"
    
      98    # 'full' enables every optional provider — the AUR binary is the
    
      99    # batteries-included experience. cargo install consumers can still opt
    
      100    # to --no-default-features and pick their own subset.
    
      101    cargo build --frozen --release --features full
    
      102}
    
      103
    
      104check() {
    
      105    cd "owlry"
    
      106    export RUSTUP_TOOLCHAIN=stable
    
      107    export CARGO_TARGET_DIR=target
    
      108    export RUSTFLAGS="-C link-arg=-fuse-ld=bfd"
    
      109    cargo test --frozen --release --features full
    
      110}
    
      111
    
      112package() {
    
      113    cd "owlry"
    
      114
    
      115    # Single binary.
    
      116    install -Dm755 "target/release/$pkgname" "$pkgdir/usr/bin/$pkgname"
    
      117
    
      118    # systemd user units (renamed from owlryd.* in v2 — see D15).
    
      119    install -Dm644 systemd/owlry.service "$pkgdir/usr/lib/systemd/user/owlry.service"
    
      120    install -Dm644 systemd/owlry.socket "$pkgdir/usr/lib/systemd/user/owlry.socket"
    
      121
    
      122    # Documentation + example configuration.
    
      123    install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      124    install -Dm644 data/owlry.example.lua "$pkgdir/usr/share/doc/$pkgname/owlry.example.lua"
    
      125    install -Dm644 data/config.example.toml "$pkgdir/usr/share/doc/$pkgname/config.example.toml"
    
      126    install -Dm644 data/style.example.css "$pkgdir/usr/share/doc/$pkgname/style.example.css"
    
      127
    
      128    # Man page.
    
      129    install -Dm644 data/owlry.1 "$pkgdir/usr/share/man/man1/owlry.1"
    
      130
    
      131    # Themes.
    
      132    install -d "$pkgdir/usr/share/$pkgname/themes"
    
      133    install -Dm644 data/themes/*.css "$pkgdir/usr/share/$pkgname/themes/"
    
      134}
    
      135

Changes since previous scan

--- PKGBUILD @ 2026-06-19 22:34
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 # Maintainer: vikingowl <christian@nachtigall.dev>
 pkgname=owlry
-pkgver=2.3.0
+pkgver=2.4.0
 pkgrel=1
 pkgdesc="Lightweight Wayland application launcher — UI, daemon, and providers in one binary"
 arch=('x86_64')
@@ -74,7 +74,7 @@
 options=('!debug')
 
 source=("$pkgname-$pkgver.tar.gz::https://somegit.dev/Owlibou/owlry/archive/owlry-v$pkgver.tar.gz")
-b2sums=('be7b84a535491291610bad6895104a4b00024e1fe9150d04a656903d5efa741f7fe35316c2739a010ecdf6de8b39897482e71aaeec55c1c23371fd262e037b00')
+b2sums=('9ba4b88bf51d86971a4ef78fb9be8504632adcb1e1b34b4e0f478b61cfde66c7fd15b3a2c1645439143cdd539eb20cc725fafee0893ed2a77d7f7e15f93269da')
 
 prepare() {
     cd "owlry"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 19:16:23	MEDIUM	1
2026-06-19 22:34:54	CLEAN	2