xk-git

maintainer premysl · 0 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The source is a git repository from the maintainer's own domain, which is plausibly the project's official host; building from source is normal for AUR, and the license is permissive, making this a low-risk, typical packaging scenario despite the non-whitelisted host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git repository from the maintainer's own domain, which is plausibly the project's official host; building from source is normal for AUR, and the license is permissive, making this a low-risk, typical packaging scenario despite the non-whitelisted host.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:16 source=("git+https://git.janouch.name/p/$_pkgname.git")

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Přemysl Eric Janouch <p@janouch.name>
2pkgname=xk-git
3_pkgname=xK
4pkgver=v2.2.0.r5.g67d044a
5pkgrel=1
6pkgdesc="IRC daemon, bot, TUI client"
7url="https://git.janouch.name/p/xK"
8arch=('i686' 'x86_64')
9license=('custom:0BSD')
10options=(zipman)
11conflicts=('xk')
12provides=('xk')
13makedepends=('cmake' 'pkg-config' 'git')
14depends=('openssl' 'ncurses')
15optdepends=('lua: support for Lua plugins (5.3, 5.4, 5.5, possibly newer)')
16source=("git+https://git.janouch.name/p/$_pkgname.git")
17sha256sums=('SKIP')
18
19pkgver() {
20 cd "$srcdir/$_pkgname"
21 ( set -o pipefail
22 git describe --long --tags 2>/dev/null | sed 's/\([^-]*-g\)/r\1/;s/-/./g' ||
23 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
24 )
25}
26
27prepare() {
28 cd "$srcdir/$_pkgname"
29 git submodule init
30 git submodule update
31}
32
33build() {
34 rm -rf "$srcdir/$_pkgname-build"
35 mkdir "$srcdir/$_pkgname-build"
36 cd "$srcdir/$_pkgname-build"
37 cmake "$srcdir/$_pkgname" -DCMAKE_BUILD_TYPE=None \
38 -DCMAKE_INSTALL_PREFIX=/usr
39 make
40}
41
42package() {
43 cd "$srcdir/$_pkgname-build"
44 make install DESTDIR=$pkgdir
45 install -Dm644 "$srcdir/$_pkgname/LICENSE" \
46 "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
47}
48

Changes since previous scan

--- PKGBUILD @ 2026-06-19 23:51
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
# Maintainer: Přemysl Eric Janouch <p@janouch.name>
pkgname=xk-git
_pkgname=xK
-pkgver=v1.5.0.r189.g26ed2db
+pkgver=v2.2.0.r5.g67d044a
pkgrel=1
pkgdesc="IRC daemon, bot, TUI client"
url="https://git.janouch.name/p/xK"
@@ -11,8 +11,8 @@
conflicts=('xk')
provides=('xk')
makedepends=('cmake' 'pkg-config' 'git')
-depends=('openssl' 'readline' 'ncurses' 'libffi')
-optdepends=('lua: support for Lua plugins (5.3, 5.4 and possibly newer)')
+depends=('openssl' 'ncurses')
+optdepends=('lua: support for Lua plugins (5.3, 5.4, 5.5, possibly newer)')
source=("git+https://git.janouch.name/p/$_pkgname.git")
sha256sums=('SKIP')

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 01:12:32 MEDIUM 1
2026-06-19 23:51:18 CLEAN 2
2026-06-19 19:07:35 LOW 2
2026-06-19 18:54:17 LOW 2
2026-06-18 16:11:54 MEDIUM 1

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion