rustypaint-git

LOW

maintainer ELEC7RO 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package downloads a prebuilt ONNX Runtime library from a non-whitelisted but project-associated CDN; however, it is used as a dependency for building a Rust application from source, and the final binary is installed locally without remote code execution or exfiltration.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt ONNX Runtime library from a non-whitelisted but project-associated CDN; however, it is used as a dependency for building a Rust application from source, and the final binary is installed locally without remote code execution or exfiltration.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source_x86_64=('onnxruntime-x86_64.tar.lzma2::https://cdn.pyke.io/0/pyke:ort-rs/ms@1.28.0/x86_64-unknown-linux-gnu.tar.lzma2')

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: ELECTRO <electro@electris.net>
    
      2
    
      3pkgname=rustypaint-git
    
      4pkgver=0.2.3.r22.ga9f31dd
    
      5pkgrel=1
    
      6pkgdesc="Paint 3D's 2D editor, without the 3D (Git version)"
    
      7arch=('x86_64' 'aarch64')
    
      8url='https://github.com/ItzELECTR0/RustyPaint'
    
      9license=('GPL-3.0-only')
    
      10depends=('fontconfig' 'libxkbcommon' 'vulkan-icd-loader' 'gcc-libs')
    
      11makedepends=('cargo' 'git')
    
      12optdepends=('xdg-desktop-portal: native file dialogs, and following the system colour scheme'
    
      13            'vulkan-radeon: AMD GPU driver'
    
      14            'nvidia-utils: NVIDIA GPU driver'
    
      15            'vulkan-intel: Intel GPU driver')
    
      16provides=('rustypaint')
    
      17conflicts=('rustypaint')
    
      18options=('!debug')
    
      19_native=1
    
      20source=('rustypaint::git+https://github.com/ItzELECTR0/RustyPaint.git')
    
      21b2sums=('SKIP')
    
      22source_x86_64=('onnxruntime-x86_64.tar.lzma2::https://cdn.pyke.io/0/pyke:ort-rs/ms@1.28.0/x86_64-unknown-linux-gnu.tar.lzma2')
    
      23source_aarch64=('onnxruntime-aarch64.tar.lzma2::https://cdn.pyke.io/0/pyke:ort-rs/ms@1.28.0/aarch64-unknown-linux-gnu.tar.lzma2')
    
      24sha256sums_x86_64=('e454f710f8a49f53aa5b4ff51e3454ae1835777e431c6c35c5255ce6f205fd68')
    
      25sha256sums_aarch64=('06a050ab9137ccb32421d0cb49e9ccf72d9e18ab0aeb8f8d038d1b5cc844b35a')
    
      26noextract=('onnxruntime-x86_64.tar.lzma2' 'onnxruntime-aarch64.tar.lzma2')
    
      27
    
      28pkgver() {
    
      29    cd rustypaint
    
      30    git describe --long --tags --abbrev=7 --match 'v[0-9]*' | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      31}
    
      32
    
      33prepare() {
    
      34    mkdir -p "$srcdir/onnxruntime"
    
      35    xz --decompress --stdout --format=raw --lzma2=dict=64MiB "$srcdir/onnxruntime-$CARCH.tar.lzma2" | tar -xf - -C "$srcdir/onnxruntime"
    
      36    cd rustypaint
    
      37    cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      38}
    
      39
    
      40build() {
    
      41    cd rustypaint
    
      42    export CARGO_TARGET_DIR=target
    
      43    export ORT_LIB_PATH="$srcdir/onnxruntime"
    
      44
    
      45    for variable in CFLAGS CXXFLAGS; do
    
      46        read -ra flags <<< "${!variable}"
    
      47        flags=("${flags[@]/#-flto*/}")
    
      48        printf -v "$variable" '%s ' "${flags[@]}"
    
      49        export "$variable"
    
      50    done
    
      51
    
      52    if [[ -n "${_native:-}" ]]; then
    
      53        export RUSTFLAGS="${RUSTFLAGS:-} -C target-cpu=native"
    
      54    fi
    
      55
    
      56    cargo build --profile dist --frozen -p rustypaint
    
      57}
    
      58
    
      59package() {
    
      60    cd rustypaint
    
      61    install -Dm755 target/dist/rustypaint "$pkgdir/usr/bin/rustypaint"
    
      62    install -Dm644 packaging/net.electris.RustyPaint.desktop \
    
      63        "$pkgdir/usr/share/applications/net.electris.RustyPaint.desktop"
    
      64    install -Dm644 packaging/flatpak/net.electris.RustyPaint.metainfo.xml \
    
      65        "$pkgdir/usr/share/metainfo/net.electris.RustyPaint.metainfo.xml"
    
      66    install -Dm644 packaging/mime/net.electris.RustyPaint.xml \
    
      67        "$pkgdir/usr/share/mime/packages/net.electris.RustyPaint.xml"
    
      68    install -Dm644 README.md "$pkgdir/usr/share/doc/rustypaint/README.md"
    
      69    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/rustypaint/LICENSE"
    
      70
    
      71    for size in 16 24 32 48 64 128 256 512; do
    
      72        install -Dm644 "res/icons/icon-$size.png" \
    
      73            "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/rustypaint.png"
    
      74    done
    
      75}
    
      76

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 00:11:52	Low	2
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 00:13:36	Low	2
2026-10-05 00:08:03	Low	2
2026-10-04 00:18:08	Low	2
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2