trizbort-qt

LOW

maintainer silverhikari 0 votes scanned 2026-09-25 19:15:26.209044

View on AUR

Why flagged

Source tarball is fetched from jxself.org, which is plausibly the project's own host matching the declared url=, with a proper sha256 checksum; the bundled patch is also checksummed; building and installing a C++/Qt project from source is normal AUR packaging with no signs of malicious behaviour, though the host is non-whitelisted and the package has few votes.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Source tarball is fetched from jxself.org, which is plausibly the project's own host matching the declared url=, with a proper sha256 checksum; the bundled patch is also checksummed; building and installing a C++/Qt project from source is normal AUR packaging with no signs of malicious behaviour, though the host is non-whitelisted and the package has few votes.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://jxself.org/${pkgname}-${pkgver}.tar.gz" "qstring.patch")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: silverhikari <kerrickethan@gmail.com>
    
      2pkgname=trizbort-qt
    
      3pkgver=1.0
    
      4pkgrel=1
    
      5pkgdesc="C++/Qt port of Trizbort, an interactive fiction Mapper"
    
      6arch=("x86_64")
    
      7url="https://jxself.org/trizbort-qt.shtml"
    
      8license=('GPL-3.0-or-later')
    
      9depends=('qt6-base' 'hicolor-icon-theme')
    
      10makedepends=('cmake')
    
      11provides=("trizbort-qt")
    
      12source=("https://jxself.org/${pkgname}-${pkgver}.tar.gz" "qstring.patch")
    
      13sha256sums=("69950425e4ff9410e2fe5d6b54252b68f8f700053bd90cd2b7d86325a5a401cc" "d730f690ccb795c99c07718011739701fb01b72ca9555557c4fd32070a2b7f65")
    
      14
    
      15prepare() {
    
      16	cd "$pkgname-$pkgver"
    
      17	# qstring patch from awesomeadam12345
    
      18	patch -p1 -i "../qstring.patch"
    
      19}
    
      20
    
      21build() {
    
      22  local cmake_options=(
    
      23    -B build
    
      24    -S $pkgname-$pkgver
    
      25    -W no-author
    
      26    -D CMAKE_BUILD_TYPE=None
    
      27    -D CMAKE_INSTALL_PREFIX=/usr
    
      28  )
    
      29  cmake "${cmake_options[@]}"
    
      30  cmake --build build
    
      31}
    
      32
    
      33package() {
    
      34	DESTDIR="$pkgdir" cmake --install build
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-25 19:15:26	Low	3
2026-09-25 19:13:08	Medium	2