pyggle-git

LOW

maintainer dreieck 0 votes scanned 2026-09-23 00:28:13.505974

View on AUR

Why flagged

The source is a git repository from the project's own domain, which is plausibly official; building from source is normal for AUR packages, even if the host is not whitelisted.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git repository from the project's own domain, which is plausibly official; building from source is normal for AUR packages, even if the host is not whitelisted.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:39 "${_pymod}::git+https://git.finalrewind.org/derf/${_pymod}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: dreieck
    
      2
    
      3_pymod=pyggle
    
      4_pkgname="${_pymod}"
    
      5pkgname="${_pkgname}-git"
    
      6epoch=1
    
      7pkgver=r72.20251230.53e06ed
    
      8pkgrel=2
    
      9pkgdesc='Python command line programme which generates a static HTML image gallery from filenames passed on the command line. It aims to do this one thing well and does not support anything else.'
    
      10url='https://finalrewind.org/projects/pyggle/'
    
      11license=(
    
      12  'BSD-2-Clause'
    
      13  #'CC0-1.0'  # This license file is present in the upstream source, but not mentioned in the python file.
    
      14  #'MIT'      # This license file is present in the upstream source, but not mentioned in the python file.
    
      15)
    
      16arch=('any')
    
      17depends=(
    
      18  'python>=3'
    
      19  'python-exifread'
    
      20  'python-pillow'
    
      21  'python-progress'
    
      22)
    
      23optdepends=(
    
      24  "python-geopy: To use 'nominatim' reverse geocoding."
    
      25)
    
      26makedepends=(
    
      27  'curl>8.7.1' # Because of https://bugs.gentoo.org/930633 / https://github.com/curl/curl/issues/13474
    
      28  'git'
    
      29)
    
      30checkdepends=()
    
      31provides=(
    
      32  "${_pkgname}"
    
      33)
    
      34conflicts=(
    
      35  "${_pkgname}"
    
      36)
    
      37options=('!emptydirs')
    
      38source=(
    
      39  "${_pymod}::git+https://git.finalrewind.org/derf/${_pymod}"
    
      40  "patch_basedir_systemwide.patch"
    
      41)
    
      42sha256sums=(
    
      43  'SKIP'
    
      44  '2c678752c1a51496cc535f74e41752be09c911989f11dd539870ca26226d420d'
    
      45)
    
      46
    
      47prepare() {
    
      48  cd "${srcdir}/${_pymod}"
    
      49
    
      50  for _patch in "${srcdir}/patch_basedir_systemwide.patch"; do
    
      51    printf '%s\n' "   > Applying patch '$(basename "${_patch}")' ..."
    
      52    patch -Np1 --follow-symlinks -i "${_patch}"
    
      53  done
    
      54
    
      55  git log > git.log
    
      56}
    
      57
    
      58pkgver() {
    
      59  cd "${srcdir}/${_pymod}"
    
      60
    
      61  _rev="$(git rev-list --count HEAD)"
    
      62  _date="$(git log -1 --date=format:"%Y%m%d" --format="%ad")"
    
      63  _hash="$(git rev-parse --short HEAD)"
    
      64
    
      65  printf '%s\n' "r${_rev}.${_date}.${_hash}"
    
      66}
    
      67
    
      68package() {
    
      69  cd "${srcdir}/${_pymod}"
    
      70
    
      71  install -D -v -m755 -t "${pkgdir}/usr/bin"  bin/${_pymod}
    
      72
    
      73  install -d -v -m755    "${pkgdir}/usr/lib/pyggle"
    
      74  cp -rv share "${pkgdir}/usr/lib/pyggle"/
    
      75
    
      76  install -D -v -m644 -t "${pkgdir}/usr/share/doc/${_pkgname}"      git.log README.md
    
      77  install -D -v -m644 -t "${pkgdir}/usr/share/licenses/${pkgname}"  LICENSES/BSD-2-Clause.txt
    
      78}
    
      79

Changes since previous scan

--- PKGBUILD @ 2026-06-20 00:18
+++ PKGBUILD @ 2026-09-23 00:28
@@ -5,7 +5,7 @@
 pkgname="${_pkgname}-git"
 epoch=1
 pkgver=r72.20251230.53e06ed
-pkgrel=1
+pkgrel=2
 pkgdesc='Python command line programme which generates a static HTML image gallery from filenames passed on the command line. It aims to do this one thing well and does not support anything else.'
 url='https://finalrewind.org/projects/pyggle/'
 license=(
@@ -36,7 +36,7 @@
 )
 options=('!emptydirs')
 source=(
-  "${_pymod}::git+https://git.finalrewind.org/${_pymod}"
+  "${_pymod}::git+https://git.finalrewind.org/derf/${_pymod}"
   "patch_basedir_systemwide.patch"
 )
 sha256sums=(

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-23 00:28:13	Low	2
2026-09-22 23:39:22	Medium	1
2026-06-20 00:18:46	Clean	2
2026-06-19 23:51:18	Clean	2
2026-06-19 19:07:35	Low	2
2026-06-18 16:11:54	Medium	1