sioyek-supernote

LOW

maintainer milad.a 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package downloads a source tarball from mupdf.com, a legitimate project host, to vendor a dependency; this is a normal build practice despite the non-whitelisted domain, and the final binary is statically linked and verified not to depend on system libraries, reducing supply-chain risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from mupdf.com, a legitimate project host, to vendor a dependency; this is a normal build practice despite the non-whitelisted domain, and the final binary is statically linked and verified not to depend on system libraries, reducing supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 "https://mupdf.com/downloads/archive/mupdf-${_mupdfver}-source.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Milad Alizadeh (git@mil.ad)
    
      2_pkgname=sioyek
    
      3pkgname="${_pkgname}-supernote"
    
      4pkgver=r2096.4719fbb2
    
      5pkgrel=1
    
      6pkgdesc="A PDF viewer designed for reading research papers and technical books with Supernote .mark file support."
    
      7arch=("x86_64" "i686" "aarch64" "armv7h" "armv6h")
    
      8url="https://github.com/mil-ad/sioyek"
    
      9license=("GPL3")
    
      10# mupdf is vendored: its SONAME encodes the minor version (libmupdf.so.28.3),
    
      11# so every system mupdf point release breaks a dynamically linked sioyek.
    
      12# Run ./update-mupdf.sh to pick up mupdf security fixes.
    
      13_mupdfver=1.28.4
    
      14depends=(qt6-wayland qt6-speech qt6-declarative qt6-svg sqlite3 zlib harfbuzz)
    
      15makedepends=("cmake" "git" "qt6-tools")
    
      16provides=("sioyek")
    
      17conflicts=("sioyek-git" "sioyek")
    
      18source=("git+https://github.com/mil-ad/sioyek.git#branch=feature/add-supernote-mark-support"
    
      19        "https://mupdf.com/downloads/archive/mupdf-${_mupdfver}-source.tar.gz")
    
      20sha512sums=('SKIP'
    
      21            '74c697fdfef8068f69fc61e9018d03fc29325f7f09e36b755e0218d0027c3ebe5d7bb3075a31a3be7dba4088380b3f638d877a0b1cadfc1ea8bb17b18667f4ed')
    
      22
    
      23pkgver() {
    
      24  cd "${srcdir}/${_pkgname}"
    
      25  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      26}
    
      27
    
      28prepare() {
    
      29  # CMakeLists.txt wants the mupdf submodule at mupdf/. The release tarball
    
      30  # stands in for it: it ships thirdparty/ populated, so no recursive fetch.
    
      31  rm -rf "${srcdir}/${_pkgname}/mupdf"
    
      32  mv "${srcdir}/mupdf-${_mupdfver}-source" "${srcdir}/${_pkgname}/mupdf"
    
      33}
    
      34
    
      35build() {
    
      36
    
      37  # As upstream's build_linux.sh, minus the apps sioyek doesn't need
    
      38  # (dropping them also keeps libX11/freeglut out of makedepends).
    
      39  # Default build=release puts the .a files in mupdf/build/release.
    
      40  make -C "${srcdir}/${_pkgname}/mupdf" \
    
      41    USE_SYSTEM_HARFBUZZ=yes \
    
      42    HAVE_X11=no \
    
      43    HAVE_GLUT=no \
    
      44    -j"$(nproc)" \
    
      45    libs
    
      46
    
      47  # CMakeLists.txt adds the mupdf link dir only on APPLE, never names
    
      48  # mupdf-third, and references ${HARFBUZZ_LIBRARIES} without ever setting it
    
      49  # -- all three are needed to resolve libmupdf.a's undefined symbols.
    
      50  # CMAKE_CXX_STANDARD_LIBRARIES puts them last, as static linking requires.
    
      51  cmake -B build -S "${srcdir}/${_pkgname}" \
    
      52    -DCMAKE_BUILD_TYPE=Release \
    
      53    -DCMAKE_PREFIX_PATH=/usr/lib/cmake/Qt6 \
    
      54    -DCMAKE_INSTALL_RPATH_USE_LINK_PATH=TRUE \
    
      55    -DCMAKE_EXE_LINKER_FLAGS="-L${srcdir}/${_pkgname}/mupdf/build/release" \
    
      56    -DCMAKE_CXX_STANDARD_LIBRARIES="-lmupdf-third $(pkg-config --libs harfbuzz)"
    
      57  cmake --build build
    
      58
    
      59  # Vendoring is pointless if we ship a binary that still needs system mupdf.
    
      60  if ldd build/sioyek | grep -q libmupdf; then
    
      61    echo "error: sioyek is still linked against the system libmupdf" >&2
    
      62    ldd build/sioyek | grep libmupdf >&2
    
      63    return 1
    
      64  fi
    
      65}
    
      66
    
      67package() {
    
      68  install -dm755 "${pkgdir}/usr/bin"
    
      69  install -dm755 "${pkgdir}/usr/share/${_pkgname}"
    
      70  install -dm755 "${pkgdir}/etc/${_pkgname}"
    
      71  install -dm755 "${pkgdir}/usr/share/applications"
    
      72  install -dm755 "${pkgdir}/usr/share/pixmaps/"
    
      73
    
      74  install -Dm755 "build/sioyek" "${pkgdir}/usr/bin/sioyek"
    
      75
    
      76  cd "${srcdir}/${_pkgname}"
    
      77
    
      78  install -Dm644 "resources/sioyek.desktop" "${pkgdir}/usr/share/applications/sioyek.desktop"
    
      79  install -Dm644 "pdf_viewer/keys.config" "${pkgdir}/etc/${_pkgname}/keys.config"
    
      80  install -Dm644 "pdf_viewer/prefs.config" "${pkgdir}/etc/${_pkgname}/prefs.config"
    
      81
    
      82  cp -r "pdf_viewer/shaders" "${pkgdir}/usr/share/${_pkgname}/"
    
      83  install -Dm644 "tutorial.pdf" "${pkgdir}/usr/share/${_pkgname}/tutorial.pdf"
    
      84
    
      85  install -Dm644 "LICENSE" "${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE"
    
      86  install -Dm644 "README.md" "${pkgdir}/usr/share/doc/${_pkgname}/README.md"
    
      87  install -Dm644 "resources/sioyek-icon-linux.png" "${pkgdir}/usr/share/pixmaps/"
    
      88
    
      89  # Install man page if it exists
    
      90  if [ -f "resources/sioyek.1" ]; then
    
      91    install -Dm644 "resources/sioyek.1" "${pkgdir}/usr/share/man/man1/sioyek.1"
    
      92  fi
    
      93}
    
      94

Changes since previous scan

--- PKGBUILD @ 2026-06-19 22:34
+++ PKGBUILD @ 2026-10-17 00:21
@@ -1,36 +1,67 @@
 # Maintainer: Milad Alizadeh (git@mil.ad)
 _pkgname=sioyek
 pkgname="${_pkgname}-supernote"
-pkgver=r2044.98bc90ff
+pkgver=r2096.4719fbb2
 pkgrel=1
 pkgdesc="A PDF viewer designed for reading research papers and technical books with Supernote .mark file support."
 arch=("x86_64" "i686" "aarch64" "armv7h" "armv6h")
 url="https://github.com/mil-ad/sioyek"
 license=("GPL3")
-depends=('libmupdf>=1.25' qt6-wayland qt6-speech qt6-declarative qt6-svg sqlite3 zlib)
+# mupdf is vendored: its SONAME encodes the minor version (libmupdf.so.28.3),
+# so every system mupdf point release breaks a dynamically linked sioyek.
+# Run ./update-mupdf.sh to pick up mupdf security fixes.
+_mupdfver=1.28.4
+depends=(qt6-wayland qt6-speech qt6-declarative qt6-svg sqlite3 zlib harfbuzz)
 makedepends=("cmake" "git" "qt6-tools")
 provides=("sioyek")
 conflicts=("sioyek-git" "sioyek")
-source=("git+https://github.com/mil-ad/sioyek.git#branch=feature/add-supernote-mark-support")
-sha512sums=("SKIP")
+source=("git+https://github.com/mil-ad/sioyek.git#branch=feature/add-supernote-mark-support"
+        "https://mupdf.com/downloads/archive/mupdf-${_mupdfver}-source.tar.gz")
+sha512sums=('SKIP'
+            '74c697fdfef8068f69fc61e9018d03fc29325f7f09e36b755e0218d0027c3ebe5d7bb3075a31a3be7dba4088380b3f638d877a0b1cadfc1ea8bb17b18667f4ed')
 
 pkgver() {
   cd "${srcdir}/${_pkgname}"
   printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
 }
 
+prepare() {
+  # CMakeLists.txt wants the mupdf submodule at mupdf/. The release tarball
+  # stands in for it: it ships thirdparty/ populated, so no recursive fetch.
+  rm -rf "${srcdir}/${_pkgname}/mupdf"
+  mv "${srcdir}/mupdf-${_mupdfver}-source" "${srcdir}/${_pkgname}/mupdf"
+}
+
 build() {
 
-  # Use system mupdf headers to match the system library version,
-  # preventing header/library version mismatch after mupdf updates.
-  mkdir -p "${srcdir}/${_pkgname}/mupdf/include"
-  ln -sfn /usr/include/mupdf "${srcdir}/${_pkgname}/mupdf/include/mupdf"
+  # As upstream's build_linux.sh, minus the apps sioyek doesn't need
+  # (dropping them also keeps libX11/freeglut out of makedepends).
+  # Default build=release puts the .a files in mupdf/build/release.
+  make -C "${srcdir}/${_pkgname}/mupdf" \
+    USE_SYSTEM_HARFBUZZ=yes \
+    HAVE_X11=no \
+    HAVE_GLUT=no \
+    -j"$(nproc)" \
+    libs
 
+  # CMakeLists.txt adds the mupdf link dir only on APPLE, never names
+  # mupdf-third, and references ${HARFBUZZ_LIBRARIES} without ever setting it
+  # -- all three are needed to resolve libmupdf.a's undefined symbols.
+  # CMAKE_CXX_STANDARD_LIBRARIES puts them last, as static linking requires.
   cmake -B build -S "${srcdir}/${_pkgname}" \
     -DCMAKE_BUILD_TYPE=Release \
     -DCMAKE_PREFIX_PATH=/usr/lib/cmake/Qt6 \
-    -DCMAKE_INSTALL_RPATH_USE_LINK_PATH=TRUE
+    -DCMAKE_INSTALL_RPATH_USE_LINK_PATH=TRUE \
+    -DCMAKE_EXE_LINKER_FLAGS="-L${srcdir}/${_pkgname}/mupdf/build/release" \
+    -DCMAKE_CXX_STANDARD_LIBRARIES="-lmupdf-third $(pkg-config --libs harfbuzz)"
   cmake --build build
+
+  # Vendoring is pointless if we ship a binary that still needs system mupdf.
+  if ldd build/sioyek | grep -q libmupdf; then
+    echo "error: sioyek is still linked against the system libmupdf" >&2
+    ldd build/sioyek | grep libmupdf >&2
+    return 1
+  fi
 }
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 13:16:10	Medium	1
2026-06-19 22:34:54	Clean	0