throne-git

LOW

maintainer Integral 6 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The use of 'go install' and 'go mod download' is part of building the project from source and fetching its own dependencies, which is standard for Go-based projects and not an external install via a package manager.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The use of 'go install' and 'go mod download' is part of building the project from source and fetching its own dependencies, which is standard for Go-based projects and not an external install via a package manager.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:44 go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
PKGBUILD:45 go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Chi_Tang <me@chitang.dev>
    
      2# Maintainer: Integral <integral@member.fsf.org>
    
      3
    
      4pkgname=throne-git
    
      5_pkgname=${pkgname%-git}
    
      6_srcname=Throne
    
      7pkgver=1.3.0.r7.g54344db
    
      8pkgrel=1
    
      9pkgdesc="Qt based cross-platform GUI proxy configuration manager (backend: sing-box)"
    
      10arch=('x86_64' 'aarch64' 'riscv64')
    
      11url="https://throneproj.github.io"
    
      12license=('GPL-3.0-or-later')
    
      13depends=('qt6-base' 'qt6-charts')
    
      14makedepends=('git' 'cmake' 'go' 'qt6-tools' 'protobuf' 'vulkan-headers')
    
      15optdepends=(
    
      16	'sing-geoip-db: geoip database for Throne'
    
      17	'sing-geosite-db: geosite database for Throne'
    
      18)
    
      19conflicts=('throne' 'nekoray-git')
    
      20provides=('throne')
    
      21replaces=('nekoray-git')
    
      22source=(
    
      23	"git+https://github.com/throneproj/${_srcname}.git"
    
      24	"https://raw.githubusercontent.com/throneproj/routeprofiles/rule-set/srslist.h"
    
      25	"${_pkgname}.sh"
    
      26	"${_srcname}.desktop"
    
      27)
    
      28sha512sums=('SKIP'
    
      29            'SKIP'
    
      30            '28275441d2d1eb3203d3d4084666d5f8f8af03e29feee97fb758f6ba87396a45876221316e11aab1a159ef8a67fe8d62d75ff8d38131cb3dca3221bb1d98085c'
    
      31            'a47e8b547bd8759e7bc5c31f6055ad5ed3f6ee5879c07de8c05349b381578f907d3bdfb833fd5296fb4b20b6cacae6b622b2ab1fc7e46fce309cb273e82bc1c5')
    
      32
    
      33pkgver() {
    
      34	git -C "${_srcname}" describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      35}
    
      36
    
      37prepare() {
    
      38	cd "${_srcname}/"
    
      39	cp "${srcdir}/srslist.h" .
    
      40
    
      41	cd core
    
      42	export GOBIN="${srcdir}/bin"
    
      43	export PATH="${PATH}:${GOBIN}"
    
      44	go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
    
      45	go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
    
      46
    
      47	export GOPATH="${srcdir}"
    
      48	go mod download -modcacherw -x
    
      49
    
      50	cd gen
    
      51	protoc -I . --go_out=. --go-grpc_out=. libcore.proto
    
      52}
    
      53
    
      54build() {
    
      55	cd "${_srcname}/"
    
      56
    
      57	cmake -B build \
    
      58		-DCMAKE_BUILD_TYPE=None \
    
      59		-DCMAKE_INSTALL_PREFIX=/usr
    
      60
    
      61	cmake --build build
    
      62
    
      63	export CGO_ENABLED=1
    
      64	export CGO_CPPFLAGS="${CPPFLAGS}"
    
      65	export CGO_CFLAGS="${CFLAGS}"
    
      66	export CGO_CXXFLAGS="${CXXFLAGS}"
    
      67	export CGO_LDFLAGS="${LDFLAGS}"
    
      68	export GOPATH="${srcdir}"
    
      69	export GOFLAGS="-buildmode=pie -mod=readonly -modcacherw"
    
      70
    
      71	cd core
    
      72	VERSION_SINGBOX=$(go list -m -f '{{.Version}}' github.com/sagernet/sing-box)
    
      73	go build -v \
    
      74		-o ../build \
    
      75		-ldflags "-compressdwarf=false -linkmode=external -X 'github.com/sagernet/sing-box/constant.Version=${VERSION_SINGBOX}' -X 'internal/godebug.defaultGODEBUG=multipathtcp=0' -checklinkname=0" \
    
      76		-tags "with_clash_api,with_gvisor,with_quic,with_wireguard,with_utls,with_dhcp,with_tailscale,with_openvpn,with_openconnect,badlinkname,tfogo_checklinkname0"
    
      77}
    
      78
    
      79package() {
    
      80	install -Dm644 "${_srcname}.desktop" -t "${pkgdir}/usr/share/applications/"
    
      81	install -Dm755 "${_pkgname}.sh" "${pkgdir}/usr/bin/${_pkgname}"
    
      82
    
      83	cd "${_srcname}/"
    
      84	install -Dm644 "res/public/${_srcname}.png" -t "${pkgdir}/usr/share/pixmaps/"
    
      85	install -Dm755 build/Throne{,Core} -t "${pkgdir}/usr/lib/${_pkgname}/"
    
      86}
    
      87

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2