streamlink-twitch-gui
LOW
maintainer bastimeyer
6 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt NW.js binary from the official nwjs.io domain, which is the project's legitimate source; despite the static analyzer flagging the host as non-standard, the binary is checksummed and used to build a legitimate application, posing minimal risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt NW.js binary from the official nwjs.io domain, which is the project's legitimate source; despite the static analyzer flagging the host as non-standard, the binary is checksummed and used to build a legitimate application, posing minimal risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:18
source_i686=("nwjs-${_nwjs}-linux32.tar.gz::https://dl.nwjs.io/v${_nwjs}/nwjs-v${_nwjs}-linux-ia32.tar.gz")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Sebastian Meyer <mail@bastimeyer.de>
2
# maintained at https://github.com/streamlink/streamlink-twitch-gui-aur
3
4
pkgname=streamlink-twitch-gui
5
pkgver=2.5.3
6
pkgrel=1
7
pkgdesc="A multi platform Twitch.tv browser for Streamlink"
8
arch=("i686" "x86_64")
9
url="https://github.com/streamlink/streamlink-twitch-gui"
10
license=("MIT")
11
depends=("alsa-lib" "gtk3" "libxss" "nss" "streamlink")
12
makedepends=("nodejs" "yarn")
13
options=(!strip)
14
15
# https://github.com/streamlink/streamlink-twitch-gui/blob/v2.5.2/build/tasks/configs/nwjs.js#L60-L81
16
_nwjs=0.83.0
17
source=("${pkgname}-${pkgver}.tar.gz::https://github.com/streamlink/${pkgname}/archive/refs/tags/v${pkgver}.tar.gz")
18
source_i686=("nwjs-${_nwjs}-linux32.tar.gz::https://dl.nwjs.io/v${_nwjs}/nwjs-v${_nwjs}-linux-ia32.tar.gz")
19
source_x86_64=("nwjs-${_nwjs}-linux64.tar.gz::https://dl.nwjs.io/v${_nwjs}/nwjs-v${_nwjs}-linux-x64.tar.gz")
20
noextract=("nwjs-${_nwjs}-linux"{32,64}".tar.gz")
21
sha256sums=('dac012e1dca9731ac3f95d7bc1d7e0f752abdd82166f89b4697189774b3035e5')
22
# https://dl.nwjs.io/${_nwjs}/SHASUMS256.txt{,.asc} (1E8BEE8D5B0C4CBCD6D19E2678680FA9E21BB40A - Roger Wang <roger@nwjs.io>)
23
sha256sums_i686=('f7df845382a0f251fc7da711988976495dc6c96530e3aac6629b28e5048ffff9')
24
sha256sums_x86_64=('cb4a0156f560b910dedfdd44b10b3aa98aa44d13f351f9b9d26e8d0ce661fbba')
25
26
[[ "${CARCH}" == "x86_64" ]] && _arch=linux64 || _arch=linux32
27
28
prepare() {
29
cd "${srcdir}/${pkgname}-${pkgver}"
30
31
# extract NW.js to the build/cache directory for nwjs-builder
32
mkdir -p "./build/cache/${_nwjs}-normal/${_arch}"
33
bsdtar -x --strip-components=1 \
34
-C "./build/cache/${_nwjs}-normal/${_arch}" \
35
-f "${srcdir}/nwjs-${_nwjs}-${_arch}.tar.gz"
36
37
# install NodeJS dependencies
38
yarn install --pure-lockfile
39
}
40
41
build() {
42
cd "${srcdir}/${pkgname}-${pkgver}"
43
yarn run grunt clean:tmp_prod webpack:prod "compile:${_arch}"
44
}
45
46
package() {
47
# the dir of the built application
48
cd "${srcdir}/${pkgname}-${pkgver}/build/releases/${pkgname}/${_arch}"
49
50
# set up package directories
51
install -d \
52
"${pkgdir}/opt/${pkgname}/" \
53
"${pkgdir}/usr/bin/" \
54
"${pkgdir}/usr/share/applications/"
55
56
# copy licenses
57
install -Dm644 \
58
-t "${pkgdir}/usr/share/licenses/${pkgname}/" \
59
"./LICENSE.txt" \
60
"./credits.html"
61
62
# copy appstream metainfo
63
install -Dm644 \
64
-t "${pkgdir}/usr/share/metainfo/" \
65
"./${pkgname}.appdata.xml"
66
67
# copy application content and remove unneeded files and dirs
68
cp -a ./ "${pkgdir}/opt/${pkgname}/"
69
rm -r "${pkgdir}/opt/${pkgname}/"{{add,remove}-menuitem.sh,LICENSE.txt,credits.html,"${pkgname}.appdata.xml",icons/}
70
71
# create custom start script and disable version check
72
cat > "${pkgdir}/usr/bin/${pkgname}" <<-EOF
73
#!/usr/bin/env bash
74
/opt/${pkgname}/${pkgname} "\$@" --no-version-check
75
EOF
76
chmod +x "${pkgdir}/usr/bin/${pkgname}"
77
78
# copy icons
79
for res in 16 32 48 64 128 256; do
80
install -Dm644 \
81
"./icons/icon-${res}.png" \
82
"${pkgdir}/usr/share/icons/hicolor/${res}x${res}/apps/${pkgname}.png"
83
done
84
85
# create menu shortcut
86
cat > "${pkgdir}/usr/share/applications/${pkgname}.desktop" <<-EOF
87
[Desktop Entry]
88
Type=Application
89
Name=Streamlink Twitch GUI
90
GenericName=Twitch.tv browser for Streamlink
91
Comment=Browse Twitch.tv and watch streams in your videoplayer of choice
92
Keywords=streamlink;twitch;streaming;
93
Categories=AudioVideo;Network;
94
StartupWMClass=streamlink-twitch-gui
95
Exec=/usr/bin/${pkgname}
96
Icon=${pkgname}
97
EOF
98
}
99
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |