webkitgtk-6.0-nova-bin

MEDIUM

maintainer novaturient 0 votes scanned 2026-10-29 07:52:02.761978

View on AUR

Why flagged

The package installs a prebuilt binary from a GitHub release hosted on a personal account with few votes and recent upload, introducing a supply-chain risk if the binary was tampered with or built from unverifiable sources.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt binary from a GitHub release hosted on a personal account with few votes and recent upload, introducing a supply-chain risk if the binary was tampered with or built from unverifiable sources.

PKGBUILD

      1# Maintainer: Novaturiente
    
      2# Prebuilt WebKitGTK 6.0 for novabrowser-webkit: PGO + x86-64-v3 + ThinLTO, no
    
      3# introspection/docs, plus the colour-filter patch (dark mode keeps dark parts dark).
    
      4# Build recipe and patch: https://github.com/Novaturiente/novabrowser-webkit/tree/master/spikes/wk-build
    
      5# Upstream source: https://webkitgtk.org/releases/webkitgtk-$pkgver.tar.xz
    
      6pkgname=webkitgtk-6.0-nova-bin
    
      7pkgver=2.54.2
    
      8pkgrel=2
    
      9pkgdesc="Web content engine for GTK 4 (PGO + x86-64-v3 + ThinLTO build with novabrowser patches, prebuilt)"
    
      10url="https://github.com/Novaturiente/novabrowser-webkit"
    
      11arch=(x86_64)
    
      12license=('LGPL-2.1-or-later' 'BSD-2-Clause')
    
      13depends=(at-spi2-core atk bubblewrap cairo enchant expat fontconfig freetype2 gdk-pixbuf2
    
      14  glib2 glibc gst-plugins-bad-libs gst-plugins-base-libs gstreamer gtk4 harfbuzz harfbuzz-icu
    
      15  hyphen icu lcms2 libatomic libavif libdrm libegl libepoxy libgcc libgcrypt libgl libgles
    
      16  libjpeg-turbo libjxl libmanette libpng libseccomp libsecret libsoup3 libstdc++ libsystemd
    
      17  libtasn1 libwebp libx11 libxml2 libxslt mesa openjpeg2 pango sqlite ttf-font wayland woff2
    
      18  xdg-dbus-proxy zlib)
    
      19optdepends=('geoclue: Geolocation support'
    
      20  'gst-libav: nonfree media decoding'
    
      21  'gst-plugins-bad: media decoding'
    
      22  'gst-plugins-good: media decoding')
    
      23provides=("webkitgtk-6.0=$pkgver" "webkitgtk-6.0-nova=$pkgver" libjavascriptcoregtk-6.0.so libwebkitgtk-6.0.so)
    
      24conflicts=(webkitgtk-6.0 webkitgtk-6.0-nova)
    
      25options=(!strip !debug)
    
      26_tag=webkitgtk-6.0-nova-$pkgver-$pkgrel
    
      27source=("$_tag-x86_64.tar.zst::$url/releases/download/$_tag/$_tag-x86_64.tar.zst")
    
      28sha256sums=('8997e67b48d294ba6b161a91e3f1be7a1d94dca4a40f2fbbc4843c075d534aa0')
    
      29
    
      30prepare() {
    
      31  /lib/ld-linux-x86-64.so.2 --help 2>/dev/null | grep -q 'x86-64-v3 (supported' || {
    
      32    error "this build needs an x86-64-v3 CPU (AVX2: Intel Haswell / AMD Excavator or newer); use webkitgtk-6.0"
    
      33    return 1
    
      34  }
    
      35}
    
      36
    
      37package() {
    
      38  cp -a "$srcdir/usr" "$pkgdir/"
    
      39}
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-29 07:52:02	Medium	2