skia-sharp-atl
maintainer txtsd
· 3 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads source tarballs from official project repositories (GitHub, GitLab, Google sources) including the main Skia fork; the non-whitelisted hosts are official project infrastructure, and all downloads are for building from source, not executing prebuilt binaries.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source tarballs from official project repositories (GitHub, GitLab, Google sources) including the main Skia fork; the non-whitelisted hosts are official project infrastructure, and all downloads are for building from source, not executing prebuilt binaries.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:69
"dng_sdk-${_commit_dng_sdk}.tar.gz::https://android.googlesource.com/platform/external/dng_sdk.git/+archive/${_commit_dng_sdk}.tar.gz" -
PKGBUILD:74
"libgav1-${_commit_libgav1}.tar.gz::https://chromium.googlesource.com/codecs/libgav1.git/+archive/${_commit_libgav1}.tar.gz"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: txtsd <aur.archlinux@ihavea.quest>
2
# Contributor: Maxime Gauduin <alucryd@archlinux.org>
3
4
pkgname=skia-sharp-atl
5
_pkgname=${pkgname%-atl}
6
pkgver=r67245.ced64f6f90
7
pkgrel=4
8
_major=99
9
_minor=9
10
_release=0
11
pkgdesc='A complete 2D graphic library for drawing Text, Geometries, and Images (Mis012 fork)'
12
arch=(x86_64 aarch64 armv7h)
13
url=https://github.com/Mis012/skia/tree/with-patches-applied
14
license=(BSD-3-Clause)
15
depends=(
16
expat
17
fontconfig
18
gcc-libs
19
glibc
20
harfbuzz
21
libfreetype.so
22
libjpeg-turbo
23
libpng
24
libwebp
25
zlib
26
)
27
makedepends=(
28
clang
29
gn
30
ninja
31
python
32
)
33
provides=(
34
libSkiaSharp.so
35
"${_pkgname}"
36
)
37
conflicts=("${_pkgname}")
38
_commit_skia='ced64f6f90cb5349de58e349309d3514cb345c28'
39
_commit_brotli='6d03dfbedda1615c4cba1211f8d81735575209c8'
40
_commit_abseil_cpp='cb436cf0142b4cbe47aae94223443df7f82e2920'
41
_commit_dng_sdk='c8d0c9b1d16bfda56f15165d39e0ffa360a11123'
42
_commit_egl_registry='a0bca08de07c7d7651047bedc0b653cfaaa4f2ae'
43
_commit_highway='424360251cdcfc314cfc528f53c872ecd63af0f0'
44
_commit_imgui='55d35d8387c15bf0cfd71861df67af8cfbda7456'
45
_commit_libavif='f49462dc93784bf34148715eee36ab6697ca0b35'
46
_commit_libgav1='0fb779c1e169fe6c229cd1fa9cc6ea6feeb441da'
47
_commit_jpeg_xl='a205468bc5d3a353fb15dae2398a101dff52f2d3'
48
_commit_libyuv='d248929c059ff7629a85333699717d7a677d8d96'
49
_commit_libmicrohttpd='748945ec6f1c67b7efc934ab0808e1d32f2fb98d'
50
_commit_oboe='b02a12d1dd821118763debec6b83d00a8a0ee419'
51
_commit_opengl_registry='14b80ebeab022b2c78f84a573f01028c96075553'
52
_commit_perfetto='93885509be1c9240bc55fa515ceb34811e54a394'
53
_commit_piex='bb217acdca1cc0c16b704669dd6f91a1b509c406'
54
_commit_vulkanmemoryallocator='7de5cc00de50e71a3aab22dea52fbb7ff4efceb6'
55
_commit_vulkan_deps='8a3971e5e9c5cddc437d1cf5e4ac1ed0728d6a49'
56
_commit_spirv_cross='12542fc6fc05000e04742daf93892a0b10edbe80'
57
_commit_spirv_headers='bdbfd019be6952fd8fa9bd5606a8798a7530c853'
58
_commit_spirv_tools='e7c6084fd1d6d6f5ac393e842728d8be309688ca'
59
_commit_vello='ef2630ad9c647b90863cb0915701d54725733968'
60
_commit_vulkan_headers='9e61870ecbd32514113b467e0a0c46f60ed222c7'
61
_commit_vulkan_tools='80b010b1e1b08c1f092fb2bfa337faadf8ea1ba3'
62
_commit_wuffs_mirror_release_c='a0041ac0310b3156b963e2f2bea09245f25ec073'
63
_commit_harfbuzz='09a266236147497bd8149240062c31c16fbc81e3'
64
_commit_zlib='c876c8f87101c5a75f6014b0f832499afeb65b73'
65
source=(
66
"${pkgname}-${_commit_skia}.tar.gz::https://github.com/Mis012/skia/archive/${_commit_skia}.tar.gz"
67
"https://github.com/google/brotli/archive/${_commit_brotli}/brotli-${_commit_brotli}.tar.gz"
68
"https://github.com/abseil/abseil-cpp/archive/${_commit_abseil_cpp}/abseil-cpp-${_commit_abseil_cpp}.tar.gz"
69
"dng_sdk-${_commit_dng_sdk}.tar.gz::https://android.googlesource.com/platform/external/dng_sdk.git/+archive/${_commit_dng_sdk}.tar.gz"
70
"https://github.com/KhronosGroup/egl-registry/archive/${_commit_egl_registry}/egl-registry-${_commit_egl_registry}.tar.gz"
71
"https://github.com/google/highway/archive/${_commit_highway}/highway-${_commit_highway}.tar.gz"
72
"https://github.com/ocornut/imgui/archive/${_commit_imgui}/imgui-${_commit_imgui}.tar.gz"
73
"https://github.com/AOMediaCodec/libavif/archive/${_commit_libavif}/libavif-${_commit_libavif}.tar.gz"
74
"libgav1-${_commit_libgav1}.tar.gz::https://chromium.googlesource.com/codecs/libgav1.git/+archive/${_commit_libgav1}.tar.gz"
75
"https://gitlab.com/wg1/jpeg-xl/-/archive/${_commit_jpeg_xl}/libjxl-${_commit_jpeg_xl}.tar.gz"
76
"libyuv-${_commit_libyuv}.tar.gz::https://chromium.googlesource.com/libyuv/libyuv.git/+archive/${_commit_libyuv}.tar.gz"
77
"microhttpd-${_commit_libmicrohttpd}.tar.gz::https://android.googlesource.com/platform/external/libmicrohttpd.git/+archive/${_commit_libmicrohttpd}.tar.gz"
78
"https://github.com/google/oboe/archive/${_commit_oboe}/oboe-${_commit_oboe}.tar.gz"
79
"https://github.com/KhronosGroup/opengl-registry/archive/${_commit_opengl_registry}/opengl-registry-${_commit_opengl_registry}.tar.gz"
80
"perfetto-${_commit_perfetto}.tar.gz::https://android.googlesource.com/platform/external/perfetto.git/+archive/${_commit_perfetto}.tar.gz"
81
"piex-${_commit_piex}.tar.gz::https://android.googlesource.com/platform/external/piex.git/+archive/${_commit_piex}.tar.gz"
82
"https://github.com/GPUOpen-LibrariesAndSDKs/vulkanmemoryallocator/archive/${_commit_vulkanmemoryallocator}/vulkanmemoryallocator-${_commit_vulkanmemoryallocator}.tar.gz"
83
"vulkan-deps-${_commit_vulkan_deps}.tar.gz::https://chromium.googlesource.com/vulkan-deps.git/+archive/${_commit_vulkan_deps}.tar.gz"
84
"https://github.com/KhronosGroup/spirv-cross/archive/${_commit_spirv_cross}/spirv-cross-${_commit_spirv_cross}.tar.gz"
85
"https://github.com/KhronosGroup/spirv-headers/archive/${_commit_spirv_headers}/spirv-headers-${_commit_spirv_headers}.tar.gz"
86
"https://github.com/KhronosGroup/spirv-tools/archive/${_commit_spirv_tools}/spirv-tools-${_commit_spirv_tools}.tar.gz"
87
"https://github.com/linebender/vello/archive/${_commit_vello}/vello-${_commit_vello}.tar.gz"
88
"https://github.com/KhronosGroup/vulkan-headers/archive/${_commit_vulkan_headers}/vulkan-headers-${_commit_vulkan_headers}.tar.gz"
89
"https://github.com/KhronosGroup/vulkan-tools/archive/${_commit_vulkan_tools}/vulkan-tools-${_commit_vulkan_tools}.tar.gz"
90
"https://github.com/google/wuffs-mirror-release-c/archive/${_commit_wuffs_mirror_release_c}/wuffs-${_commit_wuffs_mirror_release_c}.tar.gz"
91
"harfbuzz-${_commit_harfbuzz}.tar.gz::https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git/+archive/${_commit_harfbuzz}.tar.gz"
92
"zlib-${_commit_zlib}.tar.gz::https://chromium.googlesource.com/chromium/src/third_party/zlib.git/+archive/${_commit_zlib}.tar.gz"
93
)
94
noextract=(
95
"dng_sdk-${_commit_dng_sdk}.tar.gz"
96
"libgav1-${_commit_libgav1}.tar.gz"
97
"libyuv-${_commit_libyuv}.tar.gz"
98
"microhttpd-${_commit_libmicrohttpd}.tar.gz"
99
"perfetto-${_commit_perfetto}.tar.gz"
100
"piex-${_commit_piex}.tar.gz"
101
"vulkan-deps-${_commit_vulkan_deps}.tar.gz"
102
"harfbuzz-${_commit_harfbuzz}.tar.gz"
103
"zlib-${_commit_zlib}.tar.gz"
104
)
105
sha256sums=('5312c10171306082da9de117188ff1c20f313b6a66a2991a398e2a5e38c49311'
106
'0e8eea905081ce894d1616970a83b21265a13505ce06e8aa6a747fd686938d10'
107
'da7d9db9bbebc504fdedf73c615f55c50c014095c65eb422d2ced86bc855a92b'
108
'SKIP'
109
'b4f7710b158d2d9eaa7a35114613cc02f6325fd7bda82be08154720af0f48727'
110
'4aa527b67ae477b4b1ea7664fa75a882be3d4e6ca60fae4c93d6feb61739986a'
111
'684f95bd9600f97f677699320bfd77e5e33397209a74525080b8a4156b71a9fb'
112
'4b432c3566e4ea1e252ec6632e1f1c1968d670c3f22a31ed8bc48b5a4508f29d'
113
'SKIP'
114
'0125fc24e2bb98f6fbd0ba364131d816c06955640b07ffe7f3a7cd26d73e1694'
115
'SKIP'
116
'SKIP'
117
'5754de6ecd93f2afa9b9c25464806487fe037085c9fb65fb52d6a8f2a3a32831'
118
'a8f0082af2720682a0cafddeaf88292308d17c09a80d7ba016c52ca027e73b63'
119
'SKIP'
120
'SKIP'
121
'17fc50d4c356b8513d2fbcb5809d6e7a2cacbe404db11cdf4ba10a396668dbde'
122
'SKIP'
123
'15250ad527b850d8494c078509ac91d8bf829f3952f745fb72b5b226280aa9e7'
124
'607e416d19ffab113fae2b4989f05ec6cb89809290525c02beb3a912ecfb7ed2'
125
'0ba10742a1d2936758de98459447256c7ceb547b3b64ad96738fbcb26bc2cbf2'
126
'7a97b12f7f1d83e0bd9ad3b8720e201b403d644056b4423616da799696b62a5d'
127
'c1fac868ca8542c2da41da092e6980d3447aac6d99b672e4ff7ef09ca606a09f'
128
'ee947d584f8e2799c0036de4b0a1cd13fad0c8f4a663f9f8dc44418c0ac1ebb9'
129
'fdd604d71af37bd81c2dc5f65c8e114c18814562fdef7c71bdd2837e81350d6f'
130
'SKIP'
131
'SKIP')
132
133
case "${CARCH}" in
134
x86_64) _arch=x64 ;;
135
*) _arch="${CARCH}" ;;
136
esac
137
138
prepare() {
139
cd "skia-${_commit_skia}"
140
141
mkdir -p third_party/externals/{dng_sdk,libgav1,libyuv,microhttpd,perfetto,piex,vulkan-deps,harfbuzz,zlib}
142
143
bsdtar -xf "${srcdir}/dng_sdk-${_commit_dng_sdk}.tar.gz" -C third_party/externals/dng_sdk
144
bsdtar -xf "${srcdir}/libgav1-${_commit_libgav1}.tar.gz" -C third_party/externals/libgav1
145
bsdtar -xf "${srcdir}/libyuv-${_commit_libyuv}.tar.gz" -C third_party/externals/libyuv
146
bsdtar -xf "${srcdir}/microhttpd-${_commit_libmicrohttpd}.tar.gz" -C third_party/externals/microhttpd
147
bsdtar -xf "${srcdir}/perfetto-${_commit_perfetto}.tar.gz" -C third_party/externals/perfetto
148
bsdtar -xf "${srcdir}/piex-${_commit_piex}.tar.gz" -C third_party/externals/piex
149
bsdtar -xf "${srcdir}/vulkan-deps-${_commit_vulkan_deps}.tar.gz" -C third_party/externals/vulkan-deps
150
bsdtar -xf "${srcdir}/harfbuzz-${_commit_harfbuzz}.tar.gz" -C third_party/externals/harfbuzz
151
bsdtar -xf "${srcdir}/zlib-${_commit_zlib}.tar.gz" -C third_party/externals/zlib
152
153
mv "${srcdir}/brotli-${_commit_brotli}" third_party/externals/brotli
154
mv "${srcdir}/abseil-cpp-${_commit_abseil_cpp}" third_party/externals/abseil-cpp
155
mv "${srcdir}/EGL-Registry-${_commit_egl_registry}" third_party/externals/egl-registry
156
mv "${srcdir}/highway-${_commit_highway}" third_party/externals/highway
157
mv "${srcdir}/imgui-${_commit_imgui}" third_party/externals/imgui
158
mv "${srcdir}/libavif-${_commit_libavif}" third_party/externals/libavif
159
mv "${srcdir}/jpeg-xl-${_commit_jpeg_xl}" third_party/externals/libjxl
160
mv "${srcdir}/oboe-${_commit_oboe}" third_party/externals/oboe
161
mv "${srcdir}/OpenGL-Registry-${_commit_opengl_registry}" third_party/externals/opengl-registry
162
mv "${srcdir}/VulkanMemoryAllocator-${_commit_vulkanmemoryallocator}" third_party/externals/vulkanmemoryallocator
163
mv "${srcdir}/SPIRV-Cross-${_commit_spirv_cross}" third_party/externals/spirv-cross
164
mv "${srcdir}/SPIRV-Headers-${_commit_spirv_headers}" third_party/externals/spirv-headers
165
mv "${srcdir}/SPIRV-Tools-${_commit_spirv_tools}" third_party/externals/spirv-tools
166
mv "${srcdir}/vello-${_commit_vello}" third_party/externals/vello
167
mv "${srcdir}/Vulkan-Headers-${_commit_vulkan_headers}" third_party/externals/vulkan-headers
168
mv "${srcdir}/Vulkan-Tools-${_commit_vulkan_tools}" third_party/externals/vulkan-tools
169
mv "${srcdir}/wuffs-mirror-release-c-${_commit_wuffs_mirror_release_c}" third_party/externals/wuffs
170
}
171
172
build() {
173
cd "skia-${_commit_skia}"
174
175
CFLAGS="${CFLAGS} \
176
-DSKIA_C_DLL"
177
178
extra_cflags=""
179
for cflag in ${CFLAGS}; do
180
extra_cflags+="\"${cflag}\","
181
done
182
extra_ldflags=""
183
for ldflag in ${LDFLAGS}; do
184
extra_ldflags+="\"${ldflag}\","
185
done
186
187
gn gen out \
188
--args="\
189
target_os=\"linux\" \
190
target_cpu=\"x64\" \
191
cc=\"clang\" \
192
cxx=\"clang++\" \
193
extra_cflags=[${extra_cflags}] \
194
extra_ldflags=[${extra_ldflags}] \
195
skia_enable_gpu=true \
196
skia_enable_tools=false \
197
skia_use_dng_sdk=true \
198
skia_use_icu=false \
199
skia_use_piex=true \
200
skia_use_sfntly=false \
201
skia_use_system_harfbuzz=true \
202
skia_use_system_expat=true \
203
skia_use_system_freetype2=true \
204
skia_use_system_libjpeg_turbo=true \
205
skia_use_system_libpng=true \
206
skia_use_system_libwebp=true \
207
skia_use_system_zlib=true \
208
is_component_build=false \
209
is_debug=false \
210
is_official_build=true \
211
linux_soname_version=\"${_major}.${_minor}.${_release}\""
212
ninja -C out
213
}
214
215
package() {
216
install -Dm755 "skia-${_commit_skia}/out/libSkiaSharp.so.${_major}.${_minor}.${_release}" -t "${pkgdir}/usr/lib/"
217
ln -s "libSkiaSharp.so.${_major}.${_minor}.${_release}" "${pkgdir}/usr/lib/libSkiaSharp.so.${_major}"
218
ln -s "libSkiaSharp.so.${_major}.${_minor}.${_release}" "${pkgdir}/usr/lib/libSkiaSharp.so.${_major}.${_minor}"
219
ln -s "libSkiaSharp.so.${_major}" "${pkgdir}/usr/lib/libSkiaSharp.so"
220
install -Dm644 "skia-${_commit_skia}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
221
}
222
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |