skwd-lens-model

LOW

maintainer liixini 1 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package downloads a source RPM from a Fedora COPR build service, extracts it, and installs model data and license files; the host, while not standard, is a legitimate Fedora infrastructure, and the installed content is non-executable data, posing minimal risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source RPM from a Fedora COPR build service, extracts it, and installs model data and license files; the host, while not standard, is a legitimate Fedora infrastructure, and the installed content is non-executable data, posing minimal risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=("skwd-lens-model-1.0.0-1.fc44.src.rpm::https://download.copr.fedorainfracloud.org/results/piixini/skwd-wall-v2/srpm-builds/11118760/skwd-lens-model-1.0.0-1.fc44.src.rpm")

PKGBUILD

1 offending line(s) highlighted

      1pkgname=skwd-lens-model
    
      2pkgver=1.0.0
    
      3pkgrel=1
    
      4pkgdesc='Default SigLIP 2 semantic model pack for Skwd Lens'
    
      5arch=(x86_64)
    
      6url='https://github.com/liixini/skwd-lens'
    
      7license=(Apache-2.0 CC-BY-4.0 MIT)
    
      8depends=(gcc-libs glibc)
    
      9options=(!strip !debug)
    
      10source=("skwd-lens-model-1.0.0-1.fc44.src.rpm::https://download.copr.fedorainfracloud.org/results/piixini/skwd-wall-v2/srpm-builds/11118760/skwd-lens-model-1.0.0-1.fc44.src.rpm")
    
      11sha256sums=('e07cfa6166f0685d0943da6b9a6a02927a2568504caa141bf306ff99ccb3d8b0')
    
      12
    
      13prepare() {
    
      14  bsdtar -xf "$srcdir/skwd-lens-model-1.0.0-1.fc44.src.rpm" -C "$srcdir"
    
      15  bsdtar -xf "$srcdir/skwd-lens-model-1.0.0.tar.xz" -C "$srcdir"
    
      16}
    
      17
    
      18package() {
    
      19  install -d "$pkgdir/usr/share/skwd-lens/models"
    
      20  cp -a "$srcdir/$pkgname-$pkgver/semantic" "$pkgdir/usr/share/skwd-lens/models/semantic"
    
      21  install -d "$pkgdir/usr/share/licenses/$pkgname"
    
      22  install -m644 "$srcdir/$pkgname-$pkgver/licenses/"*.txt \
    
      23    "$pkgdir/usr/share/licenses/$pkgname/"
    
      24}
    
      25

Changes since previous scan

--- PKGBUILD @ 2026-10-14 00:06
+++ PKGBUILD @ 2026-10-17 00:21
@@ -7,8 +7,8 @@
 license=(Apache-2.0 CC-BY-4.0 MIT)
 depends=(gcc-libs glibc)
 options=(!strip !debug)
-source=("skwd-lens-model-1.0.0-1.fc44.src.rpm::https://download.copr.fedorainfracloud.org/results/piixini/skwd-wall-v2/srpm-builds/11043232/skwd-lens-model-1.0.0-1.fc44.src.rpm")
-sha256sums=('6f944a70d4cb9612183721c81916ce4887a4c60f0b8ec568c0432ccc2ac4b83b')
+source=("skwd-lens-model-1.0.0-1.fc44.src.rpm::https://download.copr.fedorainfracloud.org/results/piixini/skwd-wall-v2/srpm-builds/11118760/skwd-lens-model-1.0.0-1.fc44.src.rpm")
+sha256sums=('e07cfa6166f0685d0943da6b9a6a02927a2568504caa141bf306ff99ccb3d8b0')
 
 prepare() {
   bsdtar -xf "$srcdir/skwd-lens-model-1.0.0-1.fc44.src.rpm" -C "$srcdir"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 23:13:54	Medium	1
2026-10-15 00:28:05	Low	2
2026-10-14 07:19:30	Medium	1
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 00:11:52	Low	2
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 00:13:36	Low	2
2026-10-05 00:08:03	Low	2
2026-10-04 00:18:08	Low	2
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2