rokast-git

LOW

maintainer PapaCasper 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package builds from a public git repository and includes a wpa_supplicant source tarball from a known project's official host; the non-whitelisted URL is for a legitimate build dependency, and no untrusted executables are downloaded or executed.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a public git repository and includes a wpa_supplicant source tarball from a known project's official host; the non-whitelisted URL is for a legitimate build dependency, and no untrusted executables are downloaded or executed.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 'https://w1.fi/releases/wpa_supplicant-2.11.tar.gz')

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: papacasper <chj1axr0 at gmail dot com>
    
      2# Source of truth: https://github.com/papacasper/rokast/tree/main/packaging/aur (playbooks/release.md, "AUR").
    
      3pkgname=rokast-git
    
      4pkgver=0.8.1.r0.ge148716
    
      5pkgrel=1
    
      6pkgdesc='Mirror your Linux screen to a Roku TV over native Miracast, with nothing installed on the TV (git main)'
    
      7arch=(x86_64)
    
      8options=(!lto)   # makepkg's LTO builds ring's C code as GCC bitcode, which rustc's linker (lld) cannot read
    
      9url='https://github.com/papacasper/rokast'
    
      10license=(MIT)
    
      11# ffmpeg iw dhcpcd wpa_supplicant(wpa_cli) sudo openssh(ssh-keygen) are run as commands, so namcap calls them "may not be needed": they are.
    
      12depends=(ffmpeg iw dhcpcd wpa_supplicant sudo openssh libnl openssl gtk4 glib2 libgcc glibc hicolor-icon-theme)
    
      13makedepends=(cargo git)
    
      14optdepends=('xorg-xrandr: mirror one monitor on X11 instead of the whole X screen'
    
      15            'libpulse: send audio (pactl finds the audio output to capture)'
    
      16            'gstreamer: Wayland capture'
    
      17            'gst-plugins-base: Wayland capture'
    
      18            'gst-plugin-pipewire: Wayland capture'
    
      19            'xdg-desktop-portal: Wayland capture')
    
      20provides=(rokast)
    
      21conflicts=(rokast)
    
      22source=('rokast::git+https://github.com/papacasper/rokast.git'
    
      23        'https://w1.fi/releases/wpa_supplicant-2.11.tar.gz')
    
      24sha256sums=('SKIP'
    
      25            '912ea06f74e30a8e36fbb68064d6cdff218d8d591db0fc5d75dee6c81ac7fc0a')
    
      26
    
      27pkgver() {
    
      28  cd rokast
    
      29  git describe --long --tags | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      30}
    
      31
    
      32prepare() {
    
      33  cd rokast
    
      34  export RUSTUP_TOOLCHAIN=stable
    
      35  cargo fetch --locked --manifest-path ui/Cargo.toml --target "$(rustc -vV | sed -n 's/host: //p')"
    
      36  cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      37}
    
      38
    
      39build() {
    
      40  cd rokast
    
      41  export RUSTUP_TOOLCHAIN=stable CARGO_TARGET_DIR=ui/target
    
      42  cargo build --frozen --release --manifest-path ui/Cargo.toml
    
      43  CARGO_TARGET_DIR=target cargo build --frozen --release -p rokast
    
      44  ROKAST_HOSTAP_SRC="$srcdir/wpa_supplicant-2.11" ROKAST_SUPPLICANT_DIR="$srcdir/supplicant" scripts/build-supplicant
    
      45}
    
      46
    
      47check() {
    
      48  cd rokast
    
      49  export RUSTUP_TOOLCHAIN=stable
    
      50  CARGO_TARGET_DIR=target cargo test --frozen --release --workspace
    
      51  CARGO_TARGET_DIR=ui/target cargo test --frozen --release --manifest-path ui/Cargo.toml
    
      52}
    
      53
    
      54package() {
    
      55  cd rokast
    
      56  packaging/stage "$pkgdir" "$srcdir/supplicant"
    
      57  mv "$pkgdir/usr/share/licenses/rokast" "$pkgdir/usr/share/licenses/$pkgname"   # namcap wants it under $pkgname
    
      58}
    
      59

Changes since previous scan

--- PKGBUILD @ 2026-10-15 00:28
+++ PKGBUILD @ 2026-10-17 00:21
@@ -1,7 +1,7 @@
 # Maintainer: papacasper <chj1axr0 at gmail dot com>
 # Source of truth: https://github.com/papacasper/rokast/tree/main/packaging/aur (playbooks/release.md, "AUR").
 pkgname=rokast-git
-pkgver=0.7.0.r0.gbaa7232
+pkgver=0.8.1.r0.ge148716
 pkgrel=1
 pkgdesc='Mirror your Linux screen to a Roku TV over native Miracast, with nothing installed on the TV (git main)'
 arch=(x86_64)

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3
2026-10-15 03:10:23	Medium	2
2026-10-15 00:28:05	Low	3
2026-10-14 03:18:50	Medium	2
2026-10-14 01:22:29	Low	3
2026-10-14 01:18:27	Medium	2