throne
LOW
maintainer parhelia
34 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package builds from source using Go modules and does not execute external installers; the flagged pattern refers to legitimate build-time Go tool installation, not malicious external code execution.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source using Go modules and does not execute external installers; the flagged pattern refers to legitimate build-time Go tool installation, not malicious external code execution.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
External install via pipx/uv/poetry/cargo/go/gem
alt_pkg_manager_install
A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:41
go install google.golang.org/protobuf/cmd/protoc-gen-go@latest -
PKGBUILD:42
go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Mahdi Sarikhani <mahdisarikhani@outlook.com>
2
# Maintainer: parhelia
3
4
pkgname=throne
5
pkgver=1.2.4
6
pkgrel=1
7
pkgdesc="Cross-platform GUI proxy utility (Empowered by sing-box)"
8
arch=('i686' 'pentium4' 'x86_64' 'armv7h' 'aarch64' 'loongarch64' 'riscv64')
9
url="https://throneproj.github.io"
10
license=('GPL-3.0-or-later')
11
conflicts=(throne-bin throne-git throne-sysqt-bin)
12
depends=('glibc' 'qt6-base')
13
makedepends=('cmake' 'gendesk' 'git' 'go' 'lld' 'protobuf' 'qt6-tools' 'vulkan-headers')
14
source=("${pkgname}-${pkgver}.tar.gz::https://github.com/throneproj/Throne/archive/${pkgver}.tar.gz"
15
"${pkgname}.sh"
16
"git+https://github.com/throneproj/routeprofiles.git#branch=rule-set")
17
sha256sums=('004a91018f57d66797330a4c432b6a3cd4da16d9c77d00c5dc648e9392ec9586'
18
'3bb765a93afa8c4f3b4fbf4440507c79ba32e4e4600e94706ccd7705209e0c34'
19
'SKIP')
20
21
prepare() {
22
mkdir -p build
23
cp routeprofiles/srslist.h build
24
25
gendesk -f -n \
26
--pkgname "${pkgname}" \
27
--pkgdesc "${pkgdesc}" \
28
--name "${pkgname^}" \
29
--categories 'Network'
30
31
cd "${pkgname^}-${pkgver}/core/server"
32
33
# Fix stale replace directives for cronet-go (commit removed from parhelia512/cronet-go)
34
# and stale checksums in go.sum
35
sed -i '/parhelia512\/cronet-go/d' go.mod
36
: > go.sum
37
GONOSUMDB=* GONOSUMCHECK=* GOFLAGS=-mod=mod go mod tidy
38
39
export GOBIN="${srcdir}/bin"
40
export PATH="${PATH}:${GOBIN}"
41
go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
42
go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
43
44
cd gen
45
protoc -I . --go_out=. --go-grpc_out=. libcore.proto
46
}
47
48
build() {
49
export INPUT_VERSION="${pkgver}"
50
cmake -B build -S "${pkgname^}-${pkgver}" \
51
-D CMAKE_BUILD_TYPE=Release \
52
-D CMAKE_INSTALL_PREFIX=/usr \
53
-W no-dev
54
cmake --build build
55
56
cd "${pkgname^}-${pkgver}/core/server"
57
export CGO_CPPFLAGS="${CPPFLAGS}"
58
export CGO_CFLAGS="${CFLAGS} -fno-lto"
59
export CGO_CXXFLAGS="${CXXFLAGS} -fno-lto"
60
export CGO_LDFLAGS="${LDFLAGS} -fuse-ld=lld -fno-lto"
61
62
VERSION_SINGBOX=$(go list -m -f '{{.Version}}' github.com/sagernet/sing-box)
63
go build -o "${srcdir}/build" \
64
-trimpath \
65
-buildmode=pie \
66
-mod=readonly \
67
-modcacherw \
68
-ldflags="-linkmode=external -w -s -X 'github.com/sagernet/sing-box/constant.Version=${VERSION_SINGBOX}' -X 'internal/godebug.defaultGODEBUG=multipathtcp=0' -checklinkname=0" \
69
-tags="with_clash_api,with_gvisor,with_quic,with_wireguard,with_utls,with_dhcp,with_tailscale,badlinkname,tfogo_checklinkname0,with_naive_outbound"
70
}
71
72
package() {
73
install -Dm755 build/Throne{,Core} -t "${pkgdir}/usr/lib/${pkgname}"
74
install -Dm755 "${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
75
install -Dm644 "${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
76
77
cd "${pkgname^}-${pkgver}"
78
install -Dm644 res/public/Throne.png "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
79
}
80
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |