pixieditor

maintainer maralopes · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from the project's own GitHub repositories with version-tagged git sources; skipped checksums are for submodules, which is common in git-based packages, and the build process is transparent using standard .NET tooling without executing untrusted remote code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the project's own GitHub repositories with version-tagged git sources; skipped checksums are for submodules, which is common in git-based packages, and the build process is transparent using standard .NET tooling without executing untrusted remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer:  Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
    
      2
    
      3_sdk=8.0
    
      4_Name="PixiEditor"
    
      5pkgname="${_Name,,}"
    
      6pkgver=2.1.0.23
    
      7pkgrel=1
    
      8pkgdesc="All-in-one solution for 2D image editing"
    
      9arch=(
    
      10  'aarch64'
    
      11  'x86_64'
    
      12)
    
      13url="https://pixieditor.net"
    
      14_url="https://github.com/${_Name}/${_Name}"
    
      15license=(
    
      16  'LGPL-3.0-or-later'
    
      17)
    
      18depends=(
    
      19  "dotnet-runtime-${_sdk}"
    
      20  'ffmpeg'
    
      21  'hicolor-icon-theme'
    
      22  'xdg-utils'
    
      23)
    
      24makedepends=(
    
      25  "dotnet-sdk-${_sdk}-bin"
    
      26  'git'
    
      27)
    
      28options=(
    
      29  '!strip'
    
      30  '!debug'
    
      31)
    
      32_pkgsrc="${_url##*/}"
    
      33source=(
    
      34  "${_pkgsrc}::git+${_url}.git#tag=${pkgver}"
    
      35  "${_pkgsrc}-PixiDocks::git+https://github.com/PixiEditor/PixiDocks.git"
    
      36  "${_pkgsrc}-PixiParser::git+https://github.com/PixiEditor/PixiParser.git"
    
      37  "${_pkgsrc}-Drawie::git+https://github.com/PixiEditor/Drawie.git"
    
      38  "${_pkgsrc}-ColorPicker::git+https://github.com/PixiEditor/ColorPicker.git"
    
      39)
    
      40b2sums=('bcfc0db42413fa56494a4a92cd483a8d34166118a6b0a672fd308c1bea5eea83b5594454015506df8ad78c608b7b234c82692b0d174f5929d468c3c2f89b19cd'
    
      41        'SKIP'
    
      42        'SKIP'
    
      43        'SKIP'
    
      44        'SKIP')
    
      45
    
      46if   [ "${CARCH}" = 'aarch64' ]; then _msarch=arm64;
    
      47elif [ "${CARCH}" = 'armv7h'  ]; then _msarch=arm;
    
      48elif [ "${CARCH}" = 'i686'    ]; then _msarch=x86;
    
      49elif [ "${CARCH}" = 'x86_64'  ]; then _msarch=x64; fi
    
      50
    
      51_source() {
    
      52  export NUGET_PACKAGES="${srcdir}/.nuget"
    
      53  export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=true
    
      54  export DOTNET_NOLOGO=true
    
      55  export DOTNET_CLI_TELEMETRY_OPTOUT=true
    
      56}
    
      57
    
      58prepare() {
    
      59  _source
    
      60  local dotnet_options=(
    
      61    --runtime "linux-${_msarch}"
    
      62    --locked-mode
    
      63  )
    
      64
    
      65  cd "${srcdir}/${_pkgsrc}"
    
      66  git submodule init
    
      67  git config submodule.src/PixiDocks.url   "${srcdir}/${_pkgsrc}-PixiDocks"
    
      68  git config submodule.src/PixiParser.url  "${srcdir}/${_pkgsrc}-PixiParser"
    
      69  git config submodule.src/Drawie.url      "${srcdir}/${_pkgsrc}-Drawie"
    
      70  git config submodule.src/ColorPicker.url "${srcdir}/${_pkgsrc}-ColorPicker"
    
      71  git -c protocol.file.allow=always submodule update
    
      72
    
      73  dotnet restore "${dotnet_options[@]}" ./"src/${_Name}.Desktop"
    
      74
    
      75  cd "assets/flatpak"
    
      76  sed -e "s/${pkgname}.sh/${pkgname}/g" \
    
      77      -i "net.pixieditor.PixiEditor.desktop"
    
      78}
    
      79
    
      80build() {
    
      81  _source
    
      82  local dotnet_options=(
    
      83    --configuration Release
    
      84    --framework "net${_sdk}"
    
      85    # --no-restore # TODO
    
      86    --output build
    
      87    --no-self-contained
    
      88    --runtime "linux-${_msarch}"
    
      89    # --verbosity detailed
    
      90    -p:DebugType=None
    
      91    -p:DebugSymbols=false
    
      92  )
    
      93
    
      94  cd "${srcdir}/${_pkgsrc}"
    
      95  dotnet publish "${dotnet_options[@]}" ./"src/${_Name}.Desktop"
    
      96  dotnet build-server shutdown
    
      97}
    
      98
    
      99package() {
    
      100  cd "${srcdir}/${_pkgsrc}"
    
      101  install -vd "${pkgdir}/usr/bin" "${pkgdir}/usr/lib/${pkgname}"
    
      102  cp -vaT --no-preserve=ownership "build" "${pkgdir}/usr/lib/${pkgname}"
    
      103  ln -vsf "/usr/lib/${pkgname}/${_Name}.Desktop" "${pkgdir}/usr/bin/${pkgname}"
    
      104
    
      105  install -vDm644 "README.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      106
    
      107  cd "assets/flatpak"
    
      108  install -vDm644 "icon-512.png" \
    
      109    "${pkgdir}/usr/share/icons/hicolor/512x512/apps/net.pixieditor.PixiEditor.png"
    
      110  install -vDm644 "net.pixieditor.PixiEditor.desktop" \
    
      111    "${pkgdir}/usr/share/applications/net.pixieditor.PixiEditor.desktop"
    
      112  install -vDm644 net.pixieditor.PixiEditor.metainfo.xml \
    
      113    "${pkgdir}/usr/share/metainfo/net.pixieditor.PixiEditor.metainfo.xml"
    
      114  install -vDm644 net.pixieditor.PixiEditor-mime.xml \
    
      115    "${pkgdir}/usr/share/mime/packages/net.pixieditor.PixiEditor.xml"
    
      116
    
      117  install -vd "${pkgdir}/usr/share/licenses/${pkgname}"
    
      118  ln -vsf "/usr/lib/${pkgname}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      119
    
      120  ln -vsf "/usr/bin/ffmpeg" "${pkgdir}/usr/lib/${pkgname}/ThirdParty/Linux/ffmpeg/ffmpeg"
    
      121}
    
      122

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -36,7 +36,6 @@
   "${_pkgsrc}-PixiParser::git+https://github.com/PixiEditor/PixiParser.git"
   "${_pkgsrc}-Drawie::git+https://github.com/PixiEditor/Drawie.git"
   "${_pkgsrc}-ColorPicker::git+https://github.com/PixiEditor/ColorPicker.git"
-  'generator'
 )
 b2sums=('bcfc0db42413fa56494a4a92cd483a8d34166118a6b0a672fd308c1bea5eea83b5594454015506df8ad78c608b7b234c82692b0d174f5929d468c3c2f89b19cd'
         'SKIP'
@@ -61,7 +60,6 @@
   local dotnet_options=(
     --runtime "linux-${_msarch}"
     --locked-mode
-    'SKIP'
   )
 
   cd "${srcdir}/${_pkgsrc}"
@@ -80,7 +78,6 @@
 }
 
 build() {
-  sudo "$srcdir/generator"
   _source
   local dotnet_options=(
     --configuration Release
@@ -123,4 +120,3 @@
   ln -vsf "/usr/bin/ffmpeg" "${pkgdir}/usr/lib/${pkgname}/ThirdParty/Linux/ffmpeg/ffmpeg"
 }
 
-

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 17:18:23	MEDIUM	1
2026-07-31 00:14:10	LOW	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0