steamos-powerbuttond

maintainer L1bT0rch · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The source is a Git repository from the project's official GitLab instance (gitlab.steamos.cloud), which is plausibly the legitimate upstream; building from source is normal for AUR packages, and the host, while not globally whitelisted, is specific to the SteamOS project.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a Git repository from the project's official GitLab instance (gitlab.steamos.cloud), which is plausibly the legitimate upstream; building from source is normal for AUR packages, and the host, while not globally whitelisted, is specific to the SteamOS project.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("steamos-powerbuttond::git+https://gitlab.steamos.cloud/holo/powerbuttond.git#tag=$_srctag")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: L1bT0rch <L1bT0rch@proton.me>
    
      2# Contributor: Vicki Pfau (vi@endrift.com)
    
      3
    
      4pkgname=steamos-powerbuttond
    
      5_srctag=v4.2
    
      6pkgver=${_srctag##v}
    
      7pkgrel=1
    
      8arch=('x86_64')
    
      9url="https://gitlab.steamos.cloud/holo/powerbuttond"
    
      10pkgdesc="Power button daemon for SteamOS"
    
      11license=('BSD-2-Clause')
    
      12depends=('libevdev' 'udev' 'gamescope')
    
      13source=("steamos-powerbuttond::git+https://gitlab.steamos.cloud/holo/powerbuttond.git#tag=$_srctag")
    
      14replaces=('powerbuttond')
    
      15conflicts=('powerbuttond')
    
      16provides=('powerbuttond')
    
      17sha512sums=('SKIP')
    
      18
    
      19build() {
    
      20	make -C "$srcdir/$pkgname"
    
      21}
    
      22
    
      23package() {
    
      24	make -C "$srcdir/$pkgname" install DESTDIR="$pkgdir"
    
      25}
    
      26

Changes since previous scan

--- PKGBUILD @ 2026-07-06 00:10
+++ PKGBUILD @ 2026-08-18 00:03
@@ -1,19 +1,20 @@
-# Maintainer: Vicki Pfau (vi@endrift.com)
+# Maintainer: L1bT0rch <L1bT0rch@proton.me>
+# Contributor: Vicki Pfau (vi@endrift.com)
 
 pkgname=steamos-powerbuttond
-_srctag=v3.3
+_srctag=v4.2
 pkgver=${_srctag##v}
 pkgrel=1
 arch=('x86_64')
 url="https://gitlab.steamos.cloud/holo/powerbuttond"
 pkgdesc="Power button daemon for SteamOS"
-license=('BSD')
+license=('BSD-2-Clause')
 depends=('libevdev' 'udev' 'gamescope')
-source=("steamos-powerbuttond::git+https://gitlab.com/evlaV/powerbuttond.git#tag=$_srctag")
+source=("steamos-powerbuttond::git+https://gitlab.steamos.cloud/holo/powerbuttond.git#tag=$_srctag")
 replaces=('powerbuttond')
 conflicts=('powerbuttond')
 provides=('powerbuttond')
-sha512sums=('fb6c473d697ebd47932157aa1d2cff96f71df64beb0133b50e92987becd651c7b555046b38d472bf565cdba5a6ccbe80290b943638661ad45cda276a3706fefb')
+sha512sums=('SKIP')
 
 build() {
 	make -C "$srcdir/$pkgname"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 00:17:07	LOW	2
2026-08-12 05:22:53	MEDIUM	1
2026-07-06 00:10:58	CLEAN	2
2026-07-05 09:16:49	LOW	1