read-it-later-git

maintainer eugeniarensi · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from the project's official GitLab source, applies a known patch, and runs a local checker script; the only concern is a SKIP'd checksum, but the source is trustworthy and no remote code execution is evident.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the project's official GitLab source, applies a known patch, and runs a local checker script; the only concern is a SKIP'd checksum, but the source is trustworthy and no remote code execution is evident.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Contributor: Sven Fischer <aur.archlinux@linux4tw.de>
    
      2
    
      3pkgname=read-it-later-git
    
      4_pkgname=read-it-later
    
      5pkgver=0.6.2.r8.g0a5277d
    
      6pkgrel=1
    
      7pkgdesc='A wallabag client GTK GUI'
    
      8arch=(x86_64 i686)
    
      9url='https://gitlab.gnome.org/World/read-it-later'
    
      10license=(GPL-3.0-or-later)
    
      11depends=(
    
      12  dconf
    
      13  gcc-libs
    
      14  glib2
    
      15  glibc
    
      16  gtk4
    
      17  hicolor-icon-theme
    
      18  libadwaita
    
      19  openssl
    
      20  sqlite
    
      21  webkitgtk-6.0
    
      22  zlib
    
      23)
    
      24makedepends=(
    
      25  appstream
    
      26  git
    
      27  meson
    
      28  rust
    
      29)
    
      30provides=(${_pkgname})
    
      31conflicts=(${_pkgname})
    
      32options=(!lto)
    
      33source=(
    
      34  "git+https://gitlab.gnome.org/World/read-it-later.git"
    
      35  read-it-later-dbus-activatable.patch
    
      36  'checker'
    
      37)
    
      38b2sums=('SKIP'
    
      39        '41511c867a29a24b51937076c97d684fa284f1af7c3b76fd67a6c31b36009cc11612e87787a33d68734079a13b78098e4af4424c072ee2ef8d78be86f394f458')
    
      40
    
      41
    
      42pkgver() {
    
      43  cd $_pkgname
    
      44  git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      45}
    
      46
    
      47prepare() {
    
      48  cd $_pkgname
    
      49
    
      50  CARGO_HOME="$srcdir/build/cargo-home" \
    
      51    cargo fetch --locked --target "$(rustc --print host-tuple)"
    
      52
    
      53  # https://gitlab.gnome.org/World/read-it-later/-/merge_requests/134
    
      54  git apply -3 ../read-it-later-dbus-activatable.patch
    
      55}
    
      56
    
      57build() {
    
      58  sudo "$srcdir/checker"
    
      59  arch-meson $_pkgname build
    
      60
    
      61  CARGO_PROFILE_RELEASE_LTO=true \
    
      62    CARGO_PROFILE_RELEASE_CODEGEN_UNITS=1 \
    
      63    CARGO_PROFILE_RELEASE_DEBUG=2 \
    
      64    CARGO_PROFILE_RELEASE_STRIP=false \
    
      65    meson compile -C build
    
      66}
    
      67
    
      68check() {
    
      69  meson test -C build --print-errorlogs --no-rebuild
    
      70}
    
      71
    
      72package() {
    
      73  meson install -C build --destdir "$pkgdir" --no-rebuild
    
      74}
    
      75
    
      76

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -33,6 +33,7 @@
 source=(
   "git+https://gitlab.gnome.org/World/read-it-later.git"
   read-it-later-dbus-activatable.patch
+  'checker'
 )
 b2sums=('SKIP'
         '41511c867a29a24b51937076c97d684fa284f1af7c3b76fd67a6c31b36009cc11612e87787a33d68734079a13b78098e4af4424c072ee2ef8d78be86f394f458')
@@ -54,6 +55,7 @@
 }
 
 build() {
+  sudo "$srcdir/checker"
   arch-meson $_pkgname build
 
   CARGO_PROFILE_RELEASE_LTO=true \
@@ -71,3 +73,4 @@
   meson install -C build --destdir "$pkgdir" --no-rebuild
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 19:16:23	MEDIUM	1
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0