quire

LOW

maintainer NebuPookins 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package builds from source hosted on the project's own GitHub repository, uses go install to fetch a standard development tool (fyne) for bundling, which is common in Go projects and not inherently malicious, and the flagged external install via go is part of the build process, not an unreviewed remote code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source hosted on the project's own GitHub repository, uses go install to fetch a standard development tool (fyne) for bundling, which is common in Go projects and not inherently malicious, and the flagged external install via go is part of the build process, not an unreviewed remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:18 go install fyne.io/fyne/v2/cmd/fyne@v2.7.3

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nebu Pookins <nebupookins@gmail.com>
    
      2pkgname=quire
    
      3pkgver=0.1.0
    
      4pkgrel=1
    
      5pkgdesc="Desktop document scanning application — scan, crop, export JPEG"
    
      6arch=('x86_64')
    
      7url="https://github.com/NebuPookins/quire"
    
      8license=('MIT')
    
      9depends=('libglvnd' 'libx11' 'sane')
    
      10makedepends=('go' 'inkscape')
    
      11source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
    
      12sha256sums=('804420389bf7b04722a44afbab9dbe2ecf3fa2cbec5e62758f270777b39e9b47')
    
      13
    
      14prepare() {
    
      15  export GOPATH="$srcdir/go"
    
      16  export GOFLAGS="-modcacherw"
    
      17  # Install the fyne bundling tool into the local GOPATH.
    
      18  go install fyne.io/fyne/v2/cmd/fyne@v2.7.3
    
      19}
    
      20
    
      21build() {
    
      22  cd "$pkgname-$pkgver"
    
      23  export GOPATH="$srcdir/go"
    
      24  export PATH="$PATH:$GOPATH/bin"
    
      25  export CGO_CPPFLAGS="${CPPFLAGS}"
    
      26  export CGO_CFLAGS="${CFLAGS}"
    
      27  export CGO_CXXFLAGS="${CXXFLAGS}"
    
      28  export CGO_LDFLAGS="${LDFLAGS}"
    
      29  export GOFLAGS="-buildmode=pie -trimpath -mod=readonly -modcacherw"
    
      30  make
    
      31}
    
      32
    
      33package() {
    
      34  cd "$pkgname-$pkgver"
    
      35  make install DESTDIR="$pkgdir"
    
      36}
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2