pico

maintainer severach · 5 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from source hosted on a project-owned domain (alpineapp.email), applies official patches, and checksums are provided; the non-whitelisted host is plausibly official, and no remote code execution or malicious behavior is present.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source hosted on a project-owned domain (alpineapp.email), applies official patches, and checksums are provided; the non-whitelisted host is plausibly official, and no remote code execution or malicious behavior is present.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 "https://alpineapp.email/alpine/release/src/${_srcdir}.tar.xz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Chris Severance aur.severach aATt spamgourmet dott com
    
      2
    
      3set -u
    
      4_picover='5.09'
    
      5pkgname='pico'
    
      6pkgver='2.26'
    
      7pkgrel='1'
    
      8pkgdesc="the real pico text editor version ${_picover} from the Alpine Messaging System"
    
      9arch=('i686' 'x86_64')
    
      10#url='https://www.washington.edu/alpine/'
    
      11url='https://alpineapp.email/'
    
      12license=('apache')
    
      13depends=('ncurses')
    
      14makedepends=('gcc')
    
      15_srcdir="alpine-${pkgver}"
    
      16source=(
    
      17  "https://alpineapp.email/alpine/release/src/${_srcdir}.tar.xz"
    
      18  "maildir-${pkgver}.patch.gz::https://alpineapp.email/alpine/patches/alpine-${pkgver}/maildir.patch.gz"
    
      19  "fancy-${pkgver}.patch.gz::https://alpineapp.email/alpine/patches/alpine-${pkgver}/fancy.patch.gz"
    
      20  "fillpara-${pkgver}.patch.gz::https://alpineapp.email/alpine/patches/alpine-${pkgver}/fillpara.patch.gz"
    
      21  "compose-${pkgver}.patch.gz::https://alpineapp.email/alpine/patches/alpine-${pkgver}/compose.patch.gz"
    
      22  "longurl-${pkgver}.patch.gz::https://alpineapp.email/alpine/patches/alpine-${pkgver}/longurl.patch.gz"
    
      23)
    
      24md5sums=('0943b31c476276e924b02afbfaf98392'
    
      25         'a51d0537d56a5903e59f2e152e859d4d'
    
      26         'e3465d2fede6793e03535873333f79c9'
    
      27         'cb30683e7834bf61a400930a2161b6df'
    
      28         'af6eae2ba290eba783365d266255cea9'
    
      29         '4a1e702f0b52190466e48cacaee184eb')
    
      30sha256sums=('c0779c2be6c47d30554854a3e14ef5e36539502b331068851329275898a9baba'
    
      31            '57808418b02a0e1cb826940068aa10eaed827b2b23609f05fd2015ec92043d37'
    
      32            'c178459dd885e4caa32640e5ce63c689ec4752a1e039ddb149e034b935fe5181'
    
      33            '960bb9656353529964e86f0f782bf032f9aae36af9493ed7f2c8ccfd5695330f'
    
      34            '013d31d95dbf6e31c1ebfdcb745481cf31fd0df466b81e077a7538dcfe75a9f4'
    
      35            'b29b4b6f8986c4c07ce2db21b6ff27341b4f7c0844c3dee8c1c63b0536fc88b2')
    
      36
    
      37prepare() {
    
      38  local -; set -u
    
      39  cd "${_srcdir}"
    
      40  local _picoh _pver
    
      41  _picoh="$(<'pico/pico.h')"
    
      42  if [[ "${_picoh}" =~ 'version = "'([0-9.]+)'"' ]]; then
    
      43    _pver="${BASH_REMATCH[1]}"
    
      44    if [ "${_pver}" != "${_picover}" ]; then
    
      45      printf 'Update _picover=%s\n' "${_pver}"
    
      46      return 1
    
      47    fi
    
      48  else
    
      49    printf 'Cant find pico version\n'
    
      50    return 1
    
      51  fi
    
      52  printf 'Pico version %s\n' "${_picover}"
    
      53
    
      54  local _pt
    
      55  for _pt in "${source[@]%%::*}"; do
    
      56    _pt="${_pt##*/}"
    
      57    _pt="${_pt%.gz}"
    
      58    case "${_pt}" in
    
      59    *.patch)
    
      60      set +u; msg2 "Applying patch ${_pt}"; set -u
    
      61      patch --no-backup-if-mismatch -Np1 -i "${srcdir}/${_pt}"
    
      62      ;;
    
      63    esac
    
      64  done
    
      65  #cd '..'; cp -pr "${_srcdir}" 'a'; ln -s "${_srcdir}" 'b'; false
    
      66  # diff -pNaru5 'a' 'b' > "0000-$RANDOM.patch"
    
      67
    
      68  # Disable pam
    
      69  sed -e 's:am_start:omme_start:g' -i 'configure'
    
      70  #_configure
    
      71}
    
      72
    
      73_configure() {
    
      74  if [ ! -s 'Makefile' ]; then
    
      75    #CFLAGS+=' -Wno-error=incompatible-pointer-types -std=gnu17'
    
      76    CFLAGS+=' -Werror=incompatible-pointer-types'
    
      77    local _conf=(
    
      78      --prefix='/usr'
    
      79      --without-ldap
    
      80      --without-ssl
    
      81      --without-krb5
    
      82      --target='slx'
    
      83      CC='gcc -std=gnu17 -Wno-error=implicit-int'
    
      84    )
    
      85    ./configure "${_conf[@]}"
    
      86  fi
    
      87}
    
      88
    
      89build() {
    
      90  local -; set -u
    
      91  cd "${_srcdir}"
    
      92  _configure
    
      93  set -x
    
      94  nice -n1 make -j1 'c-client'
    
      95  make 'c-client.d'
    
      96  nice -n1 make -C 'pith'
    
      97  nice -n1 make -C 'pico'
    
      98}
    
      99
    
      100package() {
    
      101  local -; set -u
    
      102  cd "${_srcdir}"
    
      103  make DESTDIR="${pkgdir}" install -C 'pico'
    
      104  rm -f "${pkgdir}/usr/bin"/{pilot,alpine,rpdump,rpload}
    
      105  install -Dpm644 'doc/man1/pico.1' -t "${pkgdir}/usr/share/man/man1/"
    
      106}
    
      107set +u
    
      108

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2