throne
maintainer parhelia
· 33 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The flagged pattern involves using 'go install' to fetch development tools (protoc-gen-go, protoc-gen-go-grpc) during build preparation, which is a standard and safe practice for generating code from protobuf definitions; these tools are not installed into the final package and pose no supply-chain risk.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged pattern involves using 'go install' to fetch development tools (protoc-gen-go, protoc-gen-go-grpc) during build preparation, which is a standard and safe practice for generating code from protobuf definitions; these tools are not installed into the final package and pose no supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
External install via pipx/uv/poetry/cargo/go/gem
alt_pkg_manager_install
A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:41
go install google.golang.org/protobuf/cmd/protoc-gen-go@latest -
PKGBUILD:42
go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Mahdi Sarikhani <mahdisarikhani@outlook.com>
2
# Maintainer: parhelia
3
4
pkgname=throne
5
pkgver=1.2.2
6
pkgrel=1
7
pkgdesc="Cross-platform GUI proxy utility (Empowered by sing-box)"
8
arch=('i686' 'pentium4' 'x86_64' 'armv7h' 'aarch64' 'loongarch64' 'riscv64')
9
url="https://throneproj.github.io"
10
license=('GPL-3.0-or-later')
11
conflicts=(throne-bin throne-git throne-sysqt-bin)
12
depends=('glibc' 'qt6-base')
13
makedepends=('cmake' 'gendesk' 'git' 'go' 'lld' 'protobuf' 'qt6-tools' 'vulkan-headers')
14
source=("${pkgname}-${pkgver}.tar.gz::https://github.com/throneproj/Throne/archive/${pkgver}.tar.gz"
15
"${pkgname}.sh"
16
"git+https://github.com/throneproj/routeprofiles.git#branch=rule-set")
17
sha256sums=('c35734ed6fa91eda69cbee92440fc96cd5dc32db20d0de9c0b18ed59846a9313'
18
'3bb765a93afa8c4f3b4fbf4440507c79ba32e4e4600e94706ccd7705209e0c34'
19
'SKIP')
20
21
prepare() {
22
mkdir -p build
23
cp routeprofiles/srslist.h build
24
25
gendesk -f -n \
26
--pkgname "${pkgname}" \
27
--pkgdesc "${pkgdesc}" \
28
--name "${pkgname^}" \
29
--categories 'Network'
30
31
cd "${pkgname^}-${pkgver}/core/server"
32
33
# Fix stale replace directives for cronet-go (commit removed from parhelia512/cronet-go)
34
# and stale checksums in go.sum
35
sed -i '/parhelia512\/cronet-go/d' go.mod
36
: > go.sum
37
GONOSUMDB=* GONOSUMCHECK=* GOFLAGS=-mod=mod go mod tidy
38
39
export GOBIN="${srcdir}/bin"
40
export PATH="${PATH}:${GOBIN}"
41
go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
42
go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
43
44
cd gen
45
protoc -I . --go_out=. --go-grpc_out=. libcore.proto
46
}
47
48
build() {
49
export INPUT_VERSION="${pkgver}"
50
cmake -B build -S "${pkgname^}-${pkgver}" \
51
-D CMAKE_BUILD_TYPE=Release \
52
-D CMAKE_INSTALL_PREFIX=/usr \
53
-W no-dev
54
cmake --build build
55
56
cd "${pkgname^}-${pkgver}/core/server"
57
export CGO_CPPFLAGS="${CPPFLAGS}"
58
export CGO_CFLAGS="${CFLAGS} -fno-lto"
59
export CGO_CXXFLAGS="${CXXFLAGS} -fno-lto"
60
export CGO_LDFLAGS="${LDFLAGS} -fuse-ld=lld -fno-lto"
61
62
VERSION_SINGBOX=$(go list -m -f '{{.Version}}' github.com/sagernet/sing-box)
63
go build -o "${srcdir}/build" \
64
-trimpath \
65
-buildmode=pie \
66
-mod=readonly \
67
-modcacherw \
68
-ldflags="-linkmode=external -w -s -X 'github.com/sagernet/sing-box/constant.Version=${VERSION_SINGBOX}' -X 'internal/godebug.defaultGODEBUG=multipathtcp=0' -checklinkname=0" \
69
-tags="with_clash_api,with_gvisor,with_quic,with_wireguard,with_utls,with_dhcp,with_tailscale,badlinkname,tfogo_checklinkname0,with_naive_outbound"
70
}
71
72
package() {
73
install -Dm755 build/Throne{,Core} -t "${pkgdir}/usr/lib/${pkgname}"
74
install -Dm755 "${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
75
install -Dm644 "${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
76
77
cd "${pkgname^}-${pkgver}"
78
install -Dm644 res/public/Throne.png "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
79
}
80
Changes since previous scan
--- PKGBUILD @ 2026-07-29 00:25+++ PKGBUILD @ 2026-08-03 00:08@@ -2,7 +2,7 @@ # Maintainer: parhelia pkgname=throne-pkgver=1.2.1+pkgver=1.2.2 pkgrel=1 pkgdesc="Cross-platform GUI proxy utility (Empowered by sing-box)" arch=('i686' 'pentium4' 'x86_64' 'armv7h' 'aarch64' 'loongarch64' 'riscv64')@@ -14,7 +14,7 @@ source=("${pkgname}-${pkgver}.tar.gz::https://github.com/throneproj/Throne/archive/${pkgver}.tar.gz" "${pkgname}.sh" "git+https://github.com/throneproj/routeprofiles.git#branch=rule-set")-sha256sums=('2db86e0b7e7200a2779829404f42c26728969d7ce6f9e246f5fd22b8bda2779a'+sha256sums=('c35734ed6fa91eda69cbee92440fc96cd5dc32db20d0de9c0b18ed59846a9313' '3bb765a93afa8c4f3b4fbf4440507c79ba32e4e4600e94706ccd7705209e0c34' 'SKIP') Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 23:13:22 | MEDIUM | 1 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 09:34:56 | MEDIUM | 1 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 05:22:32 | MEDIUM | 1 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |