thunar-devel

maintainer twa022 · 16 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a legitimate tarball from the project's official archive host (archive.xfce.org), which is plausibly project-owned despite not being on the analyzer's whitelist; building from official source is normal AUR behavior and not inherently dangerous.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a legitimate tarball from the project's official archive host (archive.xfce.org), which is plausibly project-owned despite not being on the analyzer's whitelist; building from official source is normal AUR behavior and not inherently dangerous.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("https://archive.xfce.org/src/xfce/${_pkgname}/${pkgver%.*}/${_pkgname}-${pkgver}.tar.xz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: twa022 <twa022 at gmail dot com>
    
      2
    
      3_pkgname=thunar
    
      4pkgname=${_pkgname}-devel
    
      5pkgver=4.21.6
    
      6pkgrel=1
    
      7pkgdesc='File manager for Xfce (development version)'
    
      8arch=('i686' 'x86_64' 'armv7h' 'aarch64')
    
      9license=('GPL-2.0-or-later')
    
      10groups=('xfce4-devel')
    
      11url='https://thunar.xfce.org'
    
      12depends=('desktop-file-utils' 'gtk3' 'hicolor-icon-theme' 'libgudev'
    
      13         'libgexiv2' 'libnotify' 'libpng' 'libxfce4ui>=4.21.2' 'libxfce4util')
    
      14makedepends=('meson' 'xfce4-dev-tools' 'xfce4-panel' 'gtk-doc' 'gobject-introspection')
    
      15optdepends=('gvfs: trash support, mounting with udisks, and remote filesystems'
    
      16            'xfce4-panel: trash applet'
    
      17            'tumbler: for thumbnail previews'
    
      18            'thunar-volman: manages removable devices'
    
      19            'thunar-archive-plugin: create and deflate archives'
    
      20            'thunar-media-tags-plugin: view/edit id3/ogg tags'
    
      21            'catfish: file search')
    
      22provides=("${_pkgname}=${pkgver}")
    
      23conflicts=("${_pkgname}")
    
      24source=("https://archive.xfce.org/src/xfce/${_pkgname}/${pkgver%.*}/${_pkgname}-${pkgver}.tar.xz")
    
      25sha256sums=('5412d3feb14b4c47ccea8b00e9a9e3dcc1ea0e86e305abcee344f2fe82518bf8')
    
      26
    
      27build() {
    
      28  local meson_options=(
    
      29    -D gtk-doc=true
    
      30    -D gudev=enabled
    
      31    -D gexiv2=enabled
    
      32  )
    
      33
    
      34  arch-meson "${_pkgname}-${pkgver}" build "${meson_options[@]}"
    
      35  meson compile -C build
    
      36}
    
      37
    
      38package() {
    
      39  meson install -C build --destdir "$pkgdir"
    
      40}
    
      41

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,7 +2,7 @@
 
 _pkgname=thunar
 pkgname=${_pkgname}-devel
-pkgver=4.21.5
+pkgver=4.21.6
 pkgrel=1
 pkgdesc='File manager for Xfce (development version)'
 arch=('i686' 'x86_64' 'armv7h' 'aarch64')
@@ -22,7 +22,7 @@
 provides=("${_pkgname}=${pkgver}")
 conflicts=("${_pkgname}")
 source=("https://archive.xfce.org/src/xfce/${_pkgname}/${pkgver%.*}/${_pkgname}-${pkgver}.tar.xz")
-sha256sums=('eddbd4bab29c73718734e0bfcf650ceea8b4fcc8cb2cbb0b24fe22b286a2be00')
+sha256sums=('5412d3feb14b4c47ccea8b00e9a9e3dcc1ea0e86e305abcee344f2fe82518bf8')
 
 build() {
   local meson_options=(

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 17:21:24	MEDIUM	1
2026-06-19 19:07:35	CLEAN	2
2026-06-18 18:55:24	CLEAN	2
2026-06-18 16:11:54	MEDIUM	1