videodown

LOW

maintainer xmengnet 0 votes scanned 2026-11-05 12:09:09.970845

View on AUR

Why flagged

The package builds from source via a git checkout of the project's own GitHub repository, which is normal AUR packaging; the low severity is due to the SKIP'd checksum and few votes, but no malicious behavior or unverifiable prebuilt executables are present.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 90%): The package builds from source via a git checkout of the project's own GitHub repository, which is normal AUR packaging; the low severity is due to the SKIP'd checksum and few votes, but no malicious behavior or unverifiable prebuilt executables are present.

PKGBUILD

      1# Maintainer: xmengnet <my@liyp.cc>
    
      2
    
      3pkgname=videodown
    
      4pkgver=1.0.0_alpha.3
    
      5pkgrel=1
    
      6pkgdesc='哔哩哔哩、抖音、YouTube 视频下载工具（MyGo/MujicaUI 原生界面）'
    
      7arch=('x86_64' 'aarch64')
    
      8url='https://github.com/kamiertop/videodown'
    
      9license=('GPL-3.0-only')
    
      10depends=('gtk3' 'libayatana-appindicator' 'ffmpeg')
    
      11optdepends=('xdg-utils: 在文件管理器中打开下载目录')
    
      12makedepends=('go>=1.27.3' 'git')
    
      13options=('!debug')
    
      14
    
      15# pkgver 不允许连字符，tag 形如 v1.0.0-alpha.3。
    
      16_tag="v${pkgver//_/-}"
    
      17
    
      18source=("git+https://github.com/kamiertop/videodown.git#tag=${_tag}")
    
      19sha256sums=('SKIP')
    
      20
    
      21_srcname=videodown
    
      22
    
      23build() {
    
      24  cd "${_srcname}"
    
      25
    
      26  export CGO_ENABLED=0
    
      27
    
      28  local _ldflags="-s -w -bindnow -X github.com/kamiertop/videodown/internal/updater.Version=${_tag} -X github.com/kamiertop/videodown/logger.Mode=prod"
    
      29
    
      30  install -d "${srcdir}/bin"
    
      31  go build -buildmode=pie -trimpath -buildvcs=false \
    
      32    -ldflags "${_ldflags}" -o "${srcdir}/bin/videodown" .
    
      33  go build -buildmode=pie -trimpath -buildvcs=false \
    
      34    -ldflags "-s -w -bindnow" -o "${srcdir}/bin/videodown-updater" ./cmd/updater
    
      35}
    
      36
    
      37package() {
    
      38  cd "${_srcname}"
    
      39
    
      40  # 程序默认把配置/历史/日志写在可执行文件旁，/usr/lib 不可写，
    
      41  # 因此由启动器用 -data 指向用户可写目录。
    
      42  install -Dm755 "${srcdir}/bin/videodown" "${pkgdir}/usr/lib/videodown/videodown"
    
      43  install -Dm755 "${srcdir}/bin/videodown-updater" "${pkgdir}/usr/lib/videodown/videodown-updater"
    
      44
    
      45  install -d "${pkgdir}/usr/bin"
    
      46  cat > "${pkgdir}/usr/bin/videodown" <<'EOF'
    
      47#!/bin/sh
    
      48data="${XDG_DATA_HOME:-$HOME/.local/share}/videodown"
    
      49mkdir -p "$data"
    
      50exec /usr/lib/videodown/videodown -data "$data" "$@"
    
      51EOF
    
      52  chmod 755 "${pkgdir}/usr/bin/videodown"
    
      53
    
      54  sed -e '/^#/d' \
    
      55      -e 's|^Exec=.*|Exec=videodown|' \
    
      56      -e 's|^Icon=.*|Icon=videodown|' \
    
      57      build/videodown.desktop > videodown.desktop
    
      58  install -Dm644 videodown.desktop "${pkgdir}/usr/share/applications/videodown.desktop"
    
      59
    
      60  install -Dm644 build/appicon.svg "${pkgdir}/usr/share/icons/hicolor/scalable/apps/videodown.svg"
    
      61  install -Dm644 build/appicon.png "${pkgdir}/usr/share/icons/hicolor/512x512/apps/videodown.png"
    
      62
    
      63  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      64}
    
      65

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-05 12:09:09	Low	2