storyboarder
LOW
maintainer bazza
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The external download is a transparent PNG image from Wikimedia Commons used as a static asset, not executable code, and the build process otherwise uses the official source tarball and standard npm commands for a legitimate project build.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The external download is a transparent PNG image from Wikimedia Commons used as a static asset, not executable code, and the build process otherwise uses the official source tarball and standard npm commands for a legitimate project build.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
External download from an untrusted host, not in source=()
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:18
curl https://upload.wikimedia.org/wikipedia/commons/8/8c/Transparent.png > "${srcdir}"/storyboarder-${pkgver}/src/img/watermark.png
PKGBUILD
1 offending line(s) highlighted
1
#Maintainer: Bazza <bazza@riseup.net>
2
3
pkgname=('storyboarder')
4
pkgver=3.0.0
5
pkgrel=1
6
pkgdesc="The best way to visualize your story. It makes it easy to visualize a story as fast you can draw stick figures."
7
provides=("storyboarder")
8
depends=('zlib' 'hicolor-icon-theme' )
9
makedepends=('nvm' 'nodejs')
10
url='https://wonderunit.com/storyboarder/'
11
arch=('x86_64')
12
source=("https://github.com/wonderunit/storyboarder/archive/refs/tags/v${pkgver}.zip")
13
md5sums=('e4d21697c9f90adf7344a87917aa3a6f')
14
license=()
15
options=(!strip)
16
17
prepare(){
18
curl https://upload.wikimedia.org/wikipedia/commons/8/8c/Transparent.png > "${srcdir}"/storyboarder-${pkgver}/src/img/watermark.png
19
cd "${srcdir}/storyboarder-${pkgver}"
20
source /usr/share/nvm/init-nvm.sh
21
nvm install 14.16.0
22
npm install
23
npm run build
24
npm run dist:linux
25
echo "[Desktop Entry]
26
Name=Storyboader
27
Exec=/opt/storyboarder/storyboarder
28
Icon=storyboarder
29
Type=Application
30
Terminal=false
31
StartupNotify=true
32
Categories=Graphics;" > "${srcdir}"/storyboarder-${pkgver}/storyboarder.desktop
33
}
34
35
package(){
36
# opt dir
37
mkdir -p "${pkgdir}"/usr/bin/
38
echo -e '#!/bin/sh\n/opt/storyboarder/storyboarder' > "${pkgdir}"/usr/bin/storyboarder
39
chmod 755 "${pkgdir}"/usr/bin/storyboarder
40
mkdir -p "${pkgdir}"/opt/storyboarder/
41
# linux unpacked
42
cp -ar "${srcdir}"/storyboarder-${pkgver}/dist/linux-unpacked/* "${pkgdir}"/opt/storyboarder/
43
# Desktop
44
install -Dm644 "${srcdir}"/storyboarder-${pkgver}/storyboarder.desktop "${pkgdir}"/usr/share/applications/storyboarder.desktop
45
# Icon
46
install -Dm644 "${srcdir}"/storyboarder-${pkgver}/src/img/logoicon.png "${pkgdir}"/usr/share/pixmaps/storyboarder.png
47
}
48
49
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |