radicle-desktop-git

LOW

maintainer intelfx 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is a Git repository from a project-owned host (radicle.xyz), used to build the application from source; this is normal AUR packaging behavior despite the non-whitelisted domain.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a Git repository from a project-owned host (radicle.xyz), used to build the application from source; this is normal AUR packaging behavior despite the non-whitelisted domain.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:38 source=("radicle-desktop::git+https://seed.radicle.xyz/z4D5UCArafTzTQpDZNQRuqswh3ury.git")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ivan Shapovalov <intelfx@intelfx.name>
    
      2# Contributor: Thomas Scholtes <geigerzaehler@axiom.fm>
    
      3
    
      4pkgname=radicle-desktop-git
    
      5pkgver=0.9.0.r20.gcf40e86a
    
      6pkgrel=1
    
      7pkgdesc='Radicle desktop app (Git version)'
    
      8arch=('x86_64')
    
      9url='https://radicle.xyz/desktop'
    
      10license=('GPL-3.0-only')
    
      11depends=(
    
      12  'libgit2' 'libgit2.so'
    
      13  # See https://v2.tauri.app/distribute/aur/#building-from-source
    
      14  'cairo'
    
      15  'desktop-file-utils'
    
      16  'gdk-pixbuf2'
    
      17  'glib2'
    
      18  'gtk3'
    
      19  'hicolor-icon-theme'
    
      20  'libsoup'
    
      21  'pango'
    
      22  'webkit2gtk-4.1'
    
      23)
    
      24makedepends=(
    
      25  'git'
    
      26  'jq'
    
      27  # See https://v2.tauri.app/distribute/aur/#building-from-source
    
      28  'openssl'
    
      29  'appmenu-gtk-module'
    
      30  'libappindicator-gtk3'
    
      31  'librsvg'
    
      32  'cargo'
    
      33  'cargo-tauri'
    
      34  'npm'
    
      35  'pnpm'
    
      36  'nodejs'
    
      37)
    
      38source=("radicle-desktop::git+https://seed.radicle.xyz/z4D5UCArafTzTQpDZNQRuqswh3ury.git")
    
      39sha256sums=('SKIP')
    
      40
    
      41pkgver() {
    
      42	cd radicle-desktop
    
      43
    
      44	# this project does not use git tags for versioning; sunrise by hand
    
      45	local version tag count rev
    
      46	version="$(jq -r '.version' crates/radicle-tauri/tauri.conf.json)"
    
      47	tag="$(git log -1 --format=%H -G '"version"' -- crates/radicle-tauri/tauri.conf.json)"
    
      48	count="$(git rev-list --count "$tag..")"
    
      49	rev="$(git rev-parse --short HEAD)"
    
      50	if (( count > 0 )); then
    
      51		printf "%s.r%s.g%s\n" "$version" "$count" "$rev"
    
      52	else
    
      53		printf "%s\n" "$version"
    
      54	fi
    
      55}
    
      56
    
      57prepare() {
    
      58  cd radicle-desktop
    
      59
    
      60  # use cargo-tauri rather than downloading random blobs off Internet
    
      61  sed -r '\|@tauri-apps/cli|d' \
    
      62    -i package.json
    
      63
    
      64  pnpm import
    
      65  pnpm install \
    
      66    --dangerously-allow-all-builds
    
      67  cargo fetch --locked --target "$(rustc --print host-tuple)"
    
      68
    
      69  # disable ad-hoc pre-build script (we do it by hand in build(), see below)
    
      70  # inject version (transform $pkgver to be valid semver, as required by Tauri)
    
      71  # FIXME: we're transforming post-releases to pre-releases, this is not exactly right
    
      72  local semver="$pkgver"
    
      73  semver="${semver/.r/-dev.}"
    
      74  semver="${semver/.g/+}"
    
      75  jq -n '{}
    
      76    | (.build.beforeBuildCommand |= "")
    
      77    | (.version |= $semver)
    
      78  ' \
    
      79    --arg semver "$semver" \
    
      80    >tauri.conf.arch.json
    
      81}
    
      82
    
      83build() {
    
      84  cd radicle-desktop
    
      85
    
      86  # _Disable_ cross-toolchain LTO because we are using different toolchains
    
      87  # for C/C++ and Rust code (i.e., LLVM LTO is incompatible with GCC LTO).
    
      88  # In this project, C/C++ code is linked into Rust code. Therefore, apply
    
      89  # a workaround to force generation of normal object code on C side:
    
      90  CFLAGS+=" -ffat-lto-objects"
    
      91  CXXFLAGS+=" -ffat-lto-objects"
    
      92
    
      93  export LIBGIT2_NO_VENDOR=1
    
      94
    
      95  pnpm run build -- --mode production
    
      96  cargo tauri build \
    
      97    --bundles deb \
    
      98    --config tauri.conf.arch.json
    
      99}
    
      100
    
      101package() {
    
      102  depends+=(
    
      103    radicle-node
    
      104  )
    
      105
    
      106  cd radicle-desktop
    
      107  cp -vdR --preserve=mode,timestamps \
    
      108    target/release/bundle/deb/*/data \
    
      109    -T "$pkgdir"
    
      110}
    
      111

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2