throne-git

maintainer Integral · 6 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The PKGBUILD uses 'go install' and 'go build' to compile the project's own source code from a trusted GitHub repository, which is a standard and safe practice for building Go-based applications in AUR packages.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The PKGBUILD uses 'go install' and 'go build' to compile the project's own source code from a trusted GitHub repository, which is a standard and safe practice for building Go-based applications in AUR packages.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:44 go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
PKGBUILD:45 go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Chi_Tang <me@chitang.dev>
    
      2# Maintainer: Integral <integral@member.fsf.org>
    
      3
    
      4pkgname=throne-git
    
      5_pkgname=${pkgname%-git}
    
      6_srcname=Throne
    
      7pkgver=1.1.1.r71.g5bd6cb2
    
      8pkgrel=1
    
      9pkgdesc="Qt based cross-platform GUI proxy configuration manager (backend: sing-box)"
    
      10arch=('x86_64' 'aarch64' 'riscv64')
    
      11url="https://throneproj.github.io"
    
      12license=('GPL-3.0-or-later')
    
      13depends=('qt6-base' 'qt6-charts')
    
      14makedepends=('git' 'cmake' 'go' 'qt6-tools' 'protobuf' 'vulkan-headers')
    
      15optdepends=(
    
      16	'sing-geoip-db: geoip database for Throne'
    
      17	'sing-geosite-db: geosite database for Throne'
    
      18)
    
      19conflicts=('throne' 'nekoray-git')
    
      20provides=('throne')
    
      21replaces=('nekoray-git')
    
      22source=(
    
      23	"git+https://github.com/throneproj/${_srcname}.git"
    
      24	"https://raw.githubusercontent.com/throneproj/routeprofiles/rule-set/srslist.h"
    
      25	"${_pkgname}.sh"
    
      26	"${_srcname}.desktop"
    
      27)
    
      28sha512sums=('SKIP'
    
      29            'SKIP'
    
      30            '28275441d2d1eb3203d3d4084666d5f8f8af03e29feee97fb758f6ba87396a45876221316e11aab1a159ef8a67fe8d62d75ff8d38131cb3dca3221bb1d98085c'
    
      31            'a47e8b547bd8759e7bc5c31f6055ad5ed3f6ee5879c07de8c05349b381578f907d3bdfb833fd5296fb4b20b6cacae6b622b2ab1fc7e46fce309cb273e82bc1c5')
    
      32
    
      33pkgver() {
    
      34	git -C "${_srcname}" describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      35}
    
      36
    
      37prepare() {
    
      38	cd "${_srcname}/"
    
      39	cp "${srcdir}/srslist.h" .
    
      40
    
      41	cd core/server
    
      42	export GOBIN="${srcdir}/bin"
    
      43	export PATH="${PATH}:${GOBIN}"
    
      44	go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
    
      45	go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
    
      46
    
      47	cd gen
    
      48	protoc -I . --go_out=. --go-grpc_out=. libcore.proto
    
      49}
    
      50
    
      51build() {
    
      52	cd "${_srcname}/"
    
      53
    
      54	cmake -B build \
    
      55		-DCMAKE_BUILD_TYPE=None \
    
      56		-DCMAKE_INSTALL_PREFIX=/usr
    
      57
    
      58	cmake --build build
    
      59
    
      60	export CGO_CPPFLAGS="${CPPFLAGS}"
    
      61	export CGO_CFLAGS="${CFLAGS}"
    
      62	export CGO_CXXFLAGS="${CXXFLAGS}"
    
      63	export CGO_LDFLAGS="${LDFLAGS}"
    
      64
    
      65	cd core/server
    
      66	VERSION_SINGBOX=$(go list -m -f '{{.Version}}' github.com/sagernet/sing-box)
    
      67	go build -o ../../build/ \
    
      68		-buildmode=pie \
    
      69		-trimpath \
    
      70		-ldflags "-linkmode=external -w -s -X 'github.com/sagernet/sing-box/constant.Version=${VERSION_SINGBOX}' -X 'internal/godebug.defaultGODEBUG=multipathtcp=0' -checklinkname=0" \
    
      71		-mod=readonly \
    
      72		-modcacherw \
    
      73		-tags "with_clash_api,with_gvisor,with_quic,with_wireguard,with_utls,with_dhcp,with_tailscale,badlinkname,tfogo_checklinkname0,with_purego,with_naive_outbound"
    
      74}
    
      75
    
      76package() {
    
      77	install -Dm644 "${_srcname}.desktop" -t "${pkgdir}/usr/share/applications/"
    
      78	install -Dm755 "${_pkgname}.sh" "${pkgdir}/usr/bin/${_pkgname}"
    
      79
    
      80	cd "${_srcname}/"
    
      81	install -Dm644 "res/public/${_srcname}.png" -t "${pkgdir}/usr/share/pixmaps/"
    
      82	install -Dm755 build/Throne{,Core} -t "${pkgdir}/usr/lib/${_pkgname}/"
    
      83}
    
      84

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2