xk-git
maintainer premysl
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The source is a git repository from the maintainer's own domain, which is plausibly the project's official host; building from source is normal for AUR, and the license is permissive, making this a low-risk, typical packaging scenario despite the non-whitelisted host.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git repository from the maintainer's own domain, which is plausibly the project's official host; building from source is normal for AUR, and the license is permissive, making this a low-risk, typical packaging scenario despite the non-whitelisted host.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
source=("git+https://git.janouch.name/p/$_pkgname.git")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Přemysl Eric Janouch <p@janouch.name>
2
pkgname=xk-git
3
_pkgname=xK
4
pkgver=v2.2.0.r5.g67d044a
5
pkgrel=1
6
pkgdesc="IRC daemon, bot, TUI client"
7
url="https://git.janouch.name/p/xK"
8
arch=('i686' 'x86_64')
9
license=('custom:0BSD')
10
options=(zipman)
11
conflicts=('xk')
12
provides=('xk')
13
makedepends=('cmake' 'pkg-config' 'git')
14
depends=('openssl' 'ncurses')
15
optdepends=('lua: support for Lua plugins (5.3, 5.4, 5.5, possibly newer)')
16
source=("git+https://git.janouch.name/p/$_pkgname.git")
17
sha256sums=('SKIP')
18
19
pkgver() {
20
cd "$srcdir/$_pkgname"
21
( set -o pipefail
22
git describe --long --tags 2>/dev/null | sed 's/\([^-]*-g\)/r\1/;s/-/./g' ||
23
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
24
)
25
}
26
27
prepare() {
28
cd "$srcdir/$_pkgname"
29
git submodule init
30
git submodule update
31
}
32
33
build() {
34
rm -rf "$srcdir/$_pkgname-build"
35
mkdir "$srcdir/$_pkgname-build"
36
cd "$srcdir/$_pkgname-build"
37
cmake "$srcdir/$_pkgname" -DCMAKE_BUILD_TYPE=None \
38
-DCMAKE_INSTALL_PREFIX=/usr
39
make
40
}
41
42
package() {
43
cd "$srcdir/$_pkgname-build"
44
make install DESTDIR=$pkgdir
45
install -Dm644 "$srcdir/$_pkgname/LICENSE" \
46
"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
47
}
48
Changes since previous scan
--- PKGBUILD @ 2026-06-19 23:51+++ PKGBUILD @ 2026-08-03 00:08@@ -1,7 +1,7 @@ # Maintainer: Přemysl Eric Janouch <p@janouch.name> pkgname=xk-git _pkgname=xK-pkgver=v1.5.0.r189.g26ed2db+pkgver=v2.2.0.r5.g67d044a pkgrel=1 pkgdesc="IRC daemon, bot, TUI client" url="https://git.janouch.name/p/xK"@@ -11,8 +11,8 @@ conflicts=('xk') provides=('xk') makedepends=('cmake' 'pkg-config' 'git')-depends=('openssl' 'readline' 'ncurses' 'libffi')-optdepends=('lua: support for Lua plugins (5.3, 5.4 and possibly newer)')+depends=('openssl' 'ncurses')+optdepends=('lua: support for Lua plugins (5.3, 5.4, 5.5, possibly newer)') source=("git+https://git.janouch.name/p/$_pkgname.git") sha256sums=('SKIP') Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 01:12:32 | MEDIUM | 1 |
| 2026-06-19 23:51:18 | CLEAN | 2 |
| 2026-06-19 19:07:35 | LOW | 2 |
| 2026-06-19 18:54:17 | LOW | 2 |
| 2026-06-18 16:11:54 | MEDIUM | 1 |