streamlink-twitch-gui

maintainer bastimeyer · 6 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The package downloads a prebuilt NW.js binary from the official nwjs.io domain, which is the project's legitimate source; despite the static analyzer flagging the host as non-standard, the binary is checksummed and used to build a legitimate application, posing minimal risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt NW.js binary from the official nwjs.io domain, which is the project's legitimate source; despite the static analyzer flagging the host as non-standard, the binary is checksummed and used to build a legitimate application, posing minimal risk.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:18 source_i686=("nwjs-${_nwjs}-linux32.tar.gz::https://dl.nwjs.io/v${_nwjs}/nwjs-v${_nwjs}-linux-ia32.tar.gz")

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Sebastian Meyer <mail@bastimeyer.de>
2# maintained at https://github.com/streamlink/streamlink-twitch-gui-aur
3
4pkgname=streamlink-twitch-gui
5pkgver=2.5.3
6pkgrel=1
7pkgdesc="A multi platform Twitch.tv browser for Streamlink"
8arch=("i686" "x86_64")
9url="https://github.com/streamlink/streamlink-twitch-gui"
10license=("MIT")
11depends=("alsa-lib" "gtk3" "libxss" "nss" "streamlink")
12makedepends=("nodejs" "yarn")
13options=(!strip)
14
15# https://github.com/streamlink/streamlink-twitch-gui/blob/v2.5.2/build/tasks/configs/nwjs.js#L60-L81
16_nwjs=0.83.0
17source=("${pkgname}-${pkgver}.tar.gz::https://github.com/streamlink/${pkgname}/archive/refs/tags/v${pkgver}.tar.gz")
18source_i686=("nwjs-${_nwjs}-linux32.tar.gz::https://dl.nwjs.io/v${_nwjs}/nwjs-v${_nwjs}-linux-ia32.tar.gz")
19source_x86_64=("nwjs-${_nwjs}-linux64.tar.gz::https://dl.nwjs.io/v${_nwjs}/nwjs-v${_nwjs}-linux-x64.tar.gz")
20noextract=("nwjs-${_nwjs}-linux"{32,64}".tar.gz")
21sha256sums=('dac012e1dca9731ac3f95d7bc1d7e0f752abdd82166f89b4697189774b3035e5')
22# https://dl.nwjs.io/${_nwjs}/SHASUMS256.txt{,.asc} (1E8BEE8D5B0C4CBCD6D19E2678680FA9E21BB40A - Roger Wang <roger@nwjs.io>)
23sha256sums_i686=('f7df845382a0f251fc7da711988976495dc6c96530e3aac6629b28e5048ffff9')
24sha256sums_x86_64=('cb4a0156f560b910dedfdd44b10b3aa98aa44d13f351f9b9d26e8d0ce661fbba')
25
26[[ "${CARCH}" == "x86_64" ]] && _arch=linux64 || _arch=linux32
27
28prepare() {
29 cd "${srcdir}/${pkgname}-${pkgver}"
30
31 # extract NW.js to the build/cache directory for nwjs-builder
32 mkdir -p "./build/cache/${_nwjs}-normal/${_arch}"
33 bsdtar -x --strip-components=1 \
34 -C "./build/cache/${_nwjs}-normal/${_arch}" \
35 -f "${srcdir}/nwjs-${_nwjs}-${_arch}.tar.gz"
36
37 # install NodeJS dependencies
38 yarn install --pure-lockfile
39}
40
41build() {
42 cd "${srcdir}/${pkgname}-${pkgver}"
43 yarn run grunt clean:tmp_prod webpack:prod "compile:${_arch}"
44}
45
46package() {
47 # the dir of the built application
48 cd "${srcdir}/${pkgname}-${pkgver}/build/releases/${pkgname}/${_arch}"
49
50 # set up package directories
51 install -d \
52 "${pkgdir}/opt/${pkgname}/" \
53 "${pkgdir}/usr/bin/" \
54 "${pkgdir}/usr/share/applications/"
55
56 # copy licenses
57 install -Dm644 \
58 -t "${pkgdir}/usr/share/licenses/${pkgname}/" \
59 "./LICENSE.txt" \
60 "./credits.html"
61
62 # copy appstream metainfo
63 install -Dm644 \
64 -t "${pkgdir}/usr/share/metainfo/" \
65 "./${pkgname}.appdata.xml"
66
67 # copy application content and remove unneeded files and dirs
68 cp -a ./ "${pkgdir}/opt/${pkgname}/"
69 rm -r "${pkgdir}/opt/${pkgname}/"{{add,remove}-menuitem.sh,LICENSE.txt,credits.html,"${pkgname}.appdata.xml",icons/}
70
71 # create custom start script and disable version check
72 cat > "${pkgdir}/usr/bin/${pkgname}" <<-EOF
73 #!/usr/bin/env bash
74 /opt/${pkgname}/${pkgname} "\$@" --no-version-check
75 EOF
76 chmod +x "${pkgdir}/usr/bin/${pkgname}"
77
78 # copy icons
79 for res in 16 32 48 64 128 256; do
80 install -Dm644 \
81 "./icons/icon-${res}.png" \
82 "${pkgdir}/usr/share/icons/hicolor/${res}x${res}/apps/${pkgname}.png"
83 done
84
85 # create menu shortcut
86 cat > "${pkgdir}/usr/share/applications/${pkgname}.desktop" <<-EOF
87 [Desktop Entry]
88 Type=Application
89 Name=Streamlink Twitch GUI
90 GenericName=Twitch.tv browser for Streamlink
91 Comment=Browse Twitch.tv and watch streams in your videoplayer of choice
92 Keywords=streamlink;twitch;streaming;
93 Categories=AudioVideo;Network;
94 StartupWMClass=streamlink-twitch-gui
95 Exec=/usr/bin/${pkgname}
96 Icon=${pkgname}
97 EOF
98}
99

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2
2026-07-15 00:09:25 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion