svgalib-git

maintainer andreas_baumann · 1 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package builds from a legitimate git repository, applies minor patches, and installs library files; the orphaned/re-adopted status is administrative and does not imply malicious content.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a legitimate git repository, applies minor patches, and installs library files; the orphaned/re-adopted status is administrative and does not imply malicious content.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1pkgname=svgalib-git
    
      2_gitname=svgalib
    
      3pkgver=1.9.27.r0.gefe6e10
    
      4pkgrel=1
    
      5pkgdesc="A low-level SuperVGA graphics library"
    
      6arch=('i686' 'x86_64')
    
      7url="http://www.svgalib.org/"
    
      8conflicts=(svgalib)
    
      9license=('GPL')
    
      10depends=('perl')
    
      11makedepends=('git')
    
      12source=('git+https://github.com/akosela/svgalib.git'
    
      13        '0001-fix-parallel-build-race.patch'
    
      14        '0002-remove-ldconfig-call-top-makefile.patch'
    
      15        '0003-remove-ldconfig-call-src-makefile.patch')
    
      16md5sums=('SKIP'
    
      17         'de12acfa01c667abb76164ad84380fdd'
    
      18         'ca103df0772c1959b2db6eddb293a4a8'
    
      19         '4a2162161ecae03a107402cb0b1933a2')
    
      20
    
      21prepare() {
    
      22    cd "${srcdir}/${_gitname}"
    
      23    git checkout master
    
      24    patch -Np1 -i "${srcdir}/0001-fix-parallel-build-race.patch"
    
      25    patch -Np1 -i "${srcdir}/0002-remove-ldconfig-call-top-makefile.patch"
    
      26    patch -Np1 -i "${srcdir}/0003-remove-ldconfig-call-src-makefile.patch"
    
      27}
    
      28
    
      29pkgver() {
    
      30	cd "${srcdir}/${_gitname}"
    
      31	local ver=$(git describe --long --tags | sed -r 's/([^-]*-g)/r\1/;s/-/./g')
    
      32    [[ -z $ver ]] && ver=$(git describe --long --always)
    
      33    echo "$ver"
    
      34}
    
      35
    
      36package() {
    
      37  install -dm755 "${pkgdir}"/usr/lib
    
      38  
    
      39  cd ${_gitname}
    
      40  
    
      41  make prefix="${pkgdir}"/usr \
    
      42	datadir="${pkgdir}"/etc/vga \
    
      43	NO_HELPER=y \
    
      44	install
    
      45}
    
      46

Changes since previous scan

--- PKGBUILD @ 2026-08-16 00:03
+++ PKGBUILD @ 2026-08-18 00:03
@@ -14,9 +14,9 @@
         '0002-remove-ldconfig-call-top-makefile.patch'
         '0003-remove-ldconfig-call-src-makefile.patch')
 md5sums=('SKIP'
-         'SKIP'
-         'SKIP'
-         'SKIP')
+         'de12acfa01c667abb76164ad84380fdd'
+         'ca103df0772c1959b2db6eddb293a4a8'
+         '4a2162161ecae03a107402cb0b1933a2')
 
 prepare() {
     cd "${srcdir}/${_gitname}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 09:32:18	MEDIUM	1
2026-08-16 00:03:42	LOW	2
2026-08-15 17:30:51	MEDIUM	1
2026-08-15 13:30:33	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0