throne
LOW
maintainer parhelia
34 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The flagged pattern involves installing Go tools (protoc-gen-go, protoc-gen-go-grpc) during prepare(), which is a normal part of building Go-based projects and does not execute untrusted remote code; the source is the official Go modules and the build is self-contained.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged pattern involves installing Go tools (protoc-gen-go, protoc-gen-go-grpc) during prepare(), which is a normal part of building Go-based projects and does not execute untrusted remote code; the source is the official Go modules and the build is self-contained.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
External install via pipx/uv/poetry/cargo/go/gem
alt_pkg_manager_install
A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:41
go install google.golang.org/protobuf/cmd/protoc-gen-go@latest -
PKGBUILD:42
go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Mahdi Sarikhani <mahdisarikhani@outlook.com>
2
# Maintainer: parhelia
3
4
pkgname=throne
5
pkgver=1.3.0
6
pkgrel=1
7
pkgdesc="Cross-platform GUI proxy utility (Empowered by sing-box)"
8
arch=('i686' 'pentium4' 'x86_64' 'armv7h' 'aarch64' 'loongarch64' 'riscv64')
9
url="https://throneproj.github.io"
10
license=('GPL-3.0-or-later')
11
conflicts=(throne-bin throne-git throne-sysqt-bin)
12
depends=('glibc' 'qt6-base')
13
makedepends=('cmake' 'gendesk' 'git' 'go' 'lld' 'protobuf' 'qt6-tools' 'vulkan-headers')
14
source=("${pkgname}-${pkgver}.tar.gz::https://github.com/throneproj/Throne/archive/${pkgver}.tar.gz"
15
"${pkgname}.sh"
16
"git+https://github.com/throneproj/routeprofiles.git#branch=rule-set")
17
sha256sums=('93e6ff175a8fe2402ff91db0b9ac640f00c49a9a94e58d99a221e984f610cbb8'
18
'3bb765a93afa8c4f3b4fbf4440507c79ba32e4e4600e94706ccd7705209e0c34'
19
'SKIP')
20
21
prepare() {
22
mkdir -p build
23
cp routeprofiles/srslist.h build
24
25
gendesk -f -n \
26
--pkgname "${pkgname}" \
27
--pkgdesc "${pkgdesc}" \
28
--name "${pkgname^}" \
29
--categories 'Network'
30
31
cd "${pkgname^}-${pkgver}/core"
32
33
# Fix stale replace directives for cronet-go (commit removed from parhelia512/cronet-go)
34
# and stale checksums in go.sum
35
sed -i '/parhelia512\/cronet-go/d' go.mod
36
: > go.sum
37
GONOSUMDB=* GONOSUMCHECK=* GOFLAGS=-mod=mod go mod tidy
38
39
export GOBIN="${srcdir}/bin"
40
export PATH="${PATH}:${GOBIN}"
41
go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
42
go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
43
44
cd gen
45
protoc -I . --go_out=. --go-grpc_out=. libcore.proto
46
}
47
48
build() {
49
export INPUT_VERSION="${pkgver}"
50
cmake -B build -S "${pkgname^}-${pkgver}" \
51
-D CMAKE_BUILD_TYPE=Release \
52
-D CMAKE_INSTALL_PREFIX=/usr \
53
-W no-dev
54
cmake --build build
55
56
cd "${pkgname^}-${pkgver}/core"
57
export CGO_CPPFLAGS="${CPPFLAGS}"
58
export CGO_CFLAGS="${CFLAGS} -fno-lto"
59
export CGO_CXXFLAGS="${CXXFLAGS} -fno-lto"
60
export CGO_LDFLAGS="${LDFLAGS} -fuse-ld=lld -fno-lto"
61
62
VERSION_SINGBOX=$(go list -m -f '{{.Version}}' github.com/sagernet/sing-box)
63
go build -o "${srcdir}/build" \
64
-trimpath \
65
-buildmode=pie \
66
-mod=readonly \
67
-modcacherw \
68
-ldflags="-linkmode=external -w -s -X 'github.com/sagernet/sing-box/constant.Version=${VERSION_SINGBOX}' -X 'internal/godebug.defaultGODEBUG=multipathtcp=0' -checklinkname=0" \
69
-tags="with_clash_api,with_gvisor,with_quic,with_wireguard,with_utls,with_dhcp,with_tailscale,badlinkname,tfogo_checklinkname0,with_naive_outbound"
70
}
71
72
package() {
73
install -Dm755 build/Throne{,Core} -t "${pkgdir}/usr/lib/${pkgname}"
74
install -Dm755 "${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
75
install -Dm644 "${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
76
77
cd "${pkgname^}-${pkgver}"
78
install -Dm644 res/public/Throne.png "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
79
}
80
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |