quire

maintainer NebuPookins · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from source hosted on the project's own GitHub repository, uses go install to fetch a standard development tool (fyne) for bundling, which is common in Go projects and not inherently malicious, and the flagged external install via go is part of the build process, not an unreviewed remote code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source hosted on the project's own GitHub repository, uses go install to fetch a standard development tool (fyne) for bundling, which is common in Go projects and not inherently malicious, and the flagged external install via go is part of the build process, not an unreviewed remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:18 go install fyne.io/fyne/v2/cmd/fyne@v2.7.3

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nebu Pookins <nebupookins@gmail.com>
    
      2pkgname=quire
    
      3pkgver=0.1.0
    
      4pkgrel=1
    
      5pkgdesc="Desktop document scanning application — scan, crop, export JPEG"
    
      6arch=('x86_64')
    
      7url="https://github.com/NebuPookins/quire"
    
      8license=('MIT')
    
      9depends=('libglvnd' 'libx11' 'sane')
    
      10makedepends=('go' 'inkscape')
    
      11source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
    
      12sha256sums=('804420389bf7b04722a44afbab9dbe2ecf3fa2cbec5e62758f270777b39e9b47')
    
      13
    
      14prepare() {
    
      15  export GOPATH="$srcdir/go"
    
      16  export GOFLAGS="-modcacherw"
    
      17  # Install the fyne bundling tool into the local GOPATH.
    
      18  go install fyne.io/fyne/v2/cmd/fyne@v2.7.3
    
      19}
    
      20
    
      21build() {
    
      22  cd "$pkgname-$pkgver"
    
      23  export GOPATH="$srcdir/go"
    
      24  export PATH="$PATH:$GOPATH/bin"
    
      25  export CGO_CPPFLAGS="${CPPFLAGS}"
    
      26  export CGO_CFLAGS="${CFLAGS}"
    
      27  export CGO_CXXFLAGS="${CXXFLAGS}"
    
      28  export CGO_LDFLAGS="${LDFLAGS}"
    
      29  export GOFLAGS="-buildmode=pie -trimpath -mod=readonly -modcacherw"
    
      30  make
    
      31}
    
      32
    
      33package() {
    
      34  cd "$pkgname-$pkgver"
    
      35  make install DESTDIR="$pkgdir"
    
      36}
    
      37

Changes since previous scan

--- PKGBUILD @ 2026-06-30 00:36
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,52 +1,37 @@
-# Maintainer: Francisco V. <fvasquez dot public at fvtronics dot com>
+# Maintainer: Nebu Pookins <nebupookins@gmail.com>
 pkgname=quire
-pkgver=0.3.2
+pkgver=0.1.0
 pkgrel=1
-pkgdesc="Simple GNOME utility for working with local PDF files"
+pkgdesc="Desktop document scanning application — scan, crop, export JPEG"
 arch=('x86_64')
-url="https://codeberg.org/FVtronics/Quire"
-license=('GPL-3.0-or-later')
-depends=(
-    'cairo'
-    'glib2'
-    'gtk4'
-    'libadwaita'
-    'poppler-glib'
-)
-makedepends=(
-    'appstream'
-    'blueprint-compiler'
-    'cargo'
-    'desktop-file-utils'
-    'gettext'
-    'meson'
-    'ninja'
-    'pkgconf'
-)
-source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz")
-sha256sums=('96468342c71e4d7e2f6b5bc5601cddcbf25f7bcaca45f0f6fa62bf20fa6e3881')
+url="https://github.com/NebuPookins/quire"
+license=('MIT')
+depends=('libglvnd' 'libx11' 'sane')
+makedepends=('go' 'inkscape')
+source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
+sha256sums=('804420389bf7b04722a44afbab9dbe2ecf3fa2cbec5e62758f270777b39e9b47')
 
 prepare() {
-    cd "$pkgname"
-
-    export CARGO_HOME="$srcdir/cargo-home"
-    cargo fetch --locked --target "$CARCH-unknown-linux-gnu"
+  export GOPATH="$srcdir/go"
+  export GOFLAGS="-modcacherw"
+  # Install the fyne bundling tool into the local GOPATH.
+  go install fyne.io/fyne/v2/cmd/fyne@v2.7.3
 }
 
 build() {
-    meson setup "$pkgname" build \
-        --prefix=/usr \
-        --buildtype=release \
-        -Dcargo-home="$srcdir/cargo-home"
-
-    CARGO_NET_OFFLINE=true meson compile -C build
-}
-
-check() {
-    meson test -C build --print-errorlogs
+  cd "$pkgname-$pkgver"
+  export GOPATH="$srcdir/go"
+  export PATH="$PATH:$GOPATH/bin"
+  export CGO_CPPFLAGS="${CPPFLAGS}"
+  export CGO_CFLAGS="${CFLAGS}"
+  export CGO_CXXFLAGS="${CXXFLAGS}"
+  export CGO_LDFLAGS="${LDFLAGS}"
+  export GOFLAGS="-buildmode=pie -trimpath -mod=readonly -modcacherw"
+  make
 }
 
 package() {
-    meson install -C build --destdir "$pkgdir"
+  cd "$pkgname-$pkgver"
+  make install DESTDIR="$pkgdir"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 21:12:02	MEDIUM	2
2026-06-30 00:36:27	CLEAN	0
2026-06-18 16:11:54	CLEAN	0