sing-box-dashboard-git

LOW

maintainer rocka 0 votes scanned 2026-11-05 18:10:06.006573

View on AUR

Why flagged

The package builds from source using git repositories with SKIP'd checksums, but the sources are from official project and submodule URLs; no remote code execution or malicious payloads are present, though unverified sources slightly increase supply-chain risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source using git repositories with SKIP'd checksums, but the sources are from official project and submodule URLs; no remote code execution or malicious payloads are present, though unverified sources slightly increase supply-chain risk.

PKGBUILD

      1# Maintainer: Rocket Aaron <rocka@archlinuxcn.org>
    
      2
    
      3_pkgname=sing-box-dashboard
    
      4pkgname="${_pkgname}-git"
    
      5pkgver=0.0.0.r95.3e4bf08
    
      6pkgrel=1
    
      7pkgdesc="Web dashboard for sing-box"
    
      8arch=('any')
    
      9url="https://github.com/SagerNet/sing-box-dashboard"
    
      10license=('GPL-3.0-or-later')
    
      11makedepends=(git nodejs pnpm)
    
      12provides=($_pkgname)
    
      13conflicts=($_pkgname)
    
      14source=("git+${url}.git"
    
      15        "git+https://github.com/mbadolato/iTerm2-Color-Schemes.git")
    
      16sha256sums=('SKIP'
    
      17            'SKIP')
    
      18
    
      19pkgver() {
    
      20    cd "${_pkgname}"
    
      21    printf "0.0.0.r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      22}
    
      23
    
      24prepare() {
    
      25    # init submodule
    
      26    cd "${_pkgname}"
    
      27    git submodule init
    
      28    git config submodule.vendor/iterm2-color-schemes.url "${srcdir}/iTerm2-Color-Schemes"
    
      29    git -c protocol.file.allow=always submodule update
    
      30    # fix "pnpm 11.13.0 shipped a broken @pnpm/exe binary"
    
      31    sed -i '/"packageManager":/d' package.json
    
      32    # disable pnpm update notification
    
      33    pnpm config --location project set updateNotifier false
    
      34    # remove vendor fonts
    
      35    sed -i '/import "@fontsource/d' src/main.tsx
    
      36    sed -i '/src: url("@fontsource/d;
    
      37            /font-family: "Noto Color Emoji";/a src:local(Noto Color Eomji);
    
      38            /--font-sans:/c  --font-sans:sans-serif;
    
      39            /--font-serif:/c --font-serif:serif;
    
      40            /--font-mono:/c  --font-mono:monospace;
    
      41    ' src/styles/globals.css
    
      42}
    
      43
    
      44build() {
    
      45    cd "${_pkgname}"
    
      46    pnpm install --frozen-lockfile
    
      47    pnpm generate
    
      48    pnpm build
    
      49}
    
      50
    
      51check() {
    
      52    cd "${_pkgname}"
    
      53    pnpm test
    
      54}
    
      55
    
      56package() {
    
      57    mkdir -p "${pkgdir}/usr/share"
    
      58    cp -r "${_pkgname}/dist" "${pkgdir}/usr/share/${_pkgname}"
    
      59}
    
      60

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-05 18:10:06	Low	2