skwd-lens-model

LOW

maintainer liixini 0 votes scanned 2026-09-02 03:51:27.672406

View on AUR

Why flagged

Downloads a source RPM from Fedora COPR (a legitimate build infrastructure, not a personal file-sharing host), has a sha256 checksum, and installs only data files (ML model files and licenses) to /usr/share — no executed binaries or scripts, so worst-case impact of a swapped source is data/model tampering, not code execution.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads a source RPM from Fedora COPR (a legitimate build infrastructure, not a personal file-sharing host), has a sha256 checksum, and installs only data files (ML model files and licenses) to /usr/share — no executed binaries or scripts, so worst-case impact of a swapped source is data/model tampering, not code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=("skwd-lens-model-1.0.0-1.fc44.src.rpm::https://download.copr.fedorainfracloud.org/results/piixini/skwd-wall-v2/srpm-builds/10933293/skwd-lens-model-1.0.0-1.fc44.src.rpm")

PKGBUILD

1 offending line(s) highlighted

      1pkgname=skwd-lens-model
    
      2pkgver=1.0.0
    
      3pkgrel=1
    
      4pkgdesc='Default SigLIP 2 semantic model pack for Skwd Lens'
    
      5arch=(x86_64)
    
      6url='https://github.com/liixini/skwd-lens'
    
      7license=(Apache-2.0 CC-BY-4.0 MIT)
    
      8depends=(gcc-libs glibc)
    
      9options=(!strip !debug)
    
      10source=("skwd-lens-model-1.0.0-1.fc44.src.rpm::https://download.copr.fedorainfracloud.org/results/piixini/skwd-wall-v2/srpm-builds/10933293/skwd-lens-model-1.0.0-1.fc44.src.rpm")
    
      11sha256sums=('0d4da8b8432a5b1ff68ec2840b1f232a4d2707eb487e424a50ef518d7ab32490')
    
      12
    
      13prepare() {
    
      14  bsdtar -xf "$srcdir/skwd-lens-model-1.0.0-1.fc44.src.rpm" -C "$srcdir"
    
      15  bsdtar -xf "$srcdir/skwd-lens-model-1.0.0.tar.xz" -C "$srcdir"
    
      16}
    
      17
    
      18package() {
    
      19  install -d "$pkgdir/usr/share/skwd-lens/models"
    
      20  cp -a "$srcdir/$pkgname-$pkgver/semantic" "$pkgdir/usr/share/skwd-lens/models/semantic"
    
      21  install -d "$pkgdir/usr/share/licenses/$pkgname"
    
      22  install -m644 "$srcdir/$pkgname-$pkgver/licenses/"*.txt \
    
      23    "$pkgdir/usr/share/licenses/$pkgname/"
    
      24}
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-02 03:51:27	Low	3
2026-09-02 03:49:31	Medium	3