xfce4-panel-tasklist-hotkeys

LOW

maintainer Gurov 1 votes scanned 2026-09-11 09:25:47.336198

View on AUR

Why flagged

Builds xfce4-panel from the official XFCE archive with a local patch file; the source tarball comes from archive.xfce.org (the project's own infrastructure) and both checksums are provided, so the only mild concern is the bundled local patch whose content cannot be verified from the PKGBUILD alone, but this is a normal AUR customization pattern with no signs of malicious behavior.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Builds xfce4-panel from the official XFCE archive with a local patch file; the source tarball comes from archive.xfce.org (the project's own infrastructure) and both checksums are provided, so the only mild concern is the bundled local patch whose content cannot be verified from the PKGBUILD alone, but this is a normal AUR customization pattern with no signs of malicious behavior.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("https://archive.xfce.org/src/xfce/$_upstream/${pkgver%.*}/$_upstream-$pkgver.tar.bz2"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Gurov <thuggethugger1@duck.com>
    
      2pkgname=xfce4-panel-tasklist-hotkeys
    
      3_upstream=xfce4-panel
    
      4pkgver=4.20.8
    
      5pkgrel=1
    
      6pkgdesc="Panel for the Xfce desktop environment with Windows-like tasklist hotkeys"
    
      7arch=('x86_64')
    
      8url="https://docs.xfce.org/xfce/xfce4-panel/start"
    
      9license=('LGPL-2.1-only')
    
      10groups=('xfce4')
    
      11provides=("xfce4-panel=$pkgver")
    
      12conflicts=('xfce4-panel')
    
      13depends=('exo' 'garcon' 'gtk-layer-shell' 'libxfce4ui' 'xfconf' 'libwnck3' 'libdbusmenu-gtk3'
    
      14         'libxfce4windowing' 'hicolor-icon-theme' 'desktop-file-utils')
    
      15makedepends=('glib2-devel' 'xfce4-dev-tools')
    
      16source=("https://archive.xfce.org/src/xfce/$_upstream/${pkgver%.*}/$_upstream-$pkgver.tar.bz2"
    
      17  '0001-window-buttons-windows-taskbar-hotkeys.patch')
    
      18sha256sums=('d69cb1f377953aeb1fb9bdbcef12c246bea66586e3f2868f3b758e0e8ce3d3fe'
    
      19            '41509e43a516f3a6409d90536ae14d5d9e61a90bc120e71519aa85ee141808d9')
    
      20
    
      21prepare() {
    
      22  cd "$_upstream-$pkgver"
    
      23  patch -Np1 -i "../0001-window-buttons-windows-taskbar-hotkeys.patch"
    
      24}
    
      25
    
      26build() {
    
      27  cd "$_upstream-$pkgver"
    
      28  ./configure \
    
      29    --prefix=/usr \
    
      30    --sysconfdir=/etc \
    
      31    --localstatedir=/var \
    
      32    --enable-x11 \
    
      33    --enable-wayland \
    
      34    --disable-introspection \
    
      35    --disable-vala \
    
      36    --disable-gtk-doc \
    
      37    --disable-debug
    
      38  make
    
      39}
    
      40
    
      41check() {
    
      42  cd "$_upstream-$pkgver"
    
      43  make check
    
      44}
    
      45
    
      46package() {
    
      47  cd "$_upstream-$pkgver"
    
      48  make DESTDIR="$pkgdir" install
    
      49}
    
      50
    
      51# vim:set ts=2 sw=2 et:
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-11 09:25:47	Low	3
2026-09-11 09:22:22	Medium	2