yad-light

LOW

maintainer sfs 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a source RPM from a legitimate project-related but non-whitelisted host (ALT Linux); however, it extracts and builds from the contained source code, which is normal AUR packaging behavior, and the final installed binaries are compiled locally from this source.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package downloads a source RPM from a legitimate project-related but non-whitelisted host (ALT Linux); however, it extracts and builds from the contained source code, which is normal AUR packaging behavior, and the final installed binaries are compiled locally from this source.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("https://ftp.altlinux.org/pub/distributions/ALTLinux/Sisyphus/files/SRPMS/${_pkgname}-${pkgver}-alt1.src.rpm"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: sfs sfslinux@gmail.com
    
      2
    
      3pkgname=yad-light
    
      4_pkgname=yad
    
      5pkgver=15.0
    
      6pkgrel=7
    
      7pkgdesc='A fork of zenity - display graphical dialogs from shell scripts or command line (without HTML, AppIndicator, spell check and GtkSourceView)'
    
      8url='https://github.com/v1cont/yad'
    
      9arch=('x86_64')
    
      10license=('GPL3')
    
      11depends=('gtk3')
    
      12makedepends=('autoconf' 'automake' 'gettext')
    
      13optdepends=(
    
      14  'xdg-utils: open links from --text-info --show-uri and --icons (default OpenCommand)'
    
      15  'xterm: terminal for --icons entries with Terminal=true (default Terminal setting)'
    
      16  'xorg-xwayland: X11-only modes (--notebook, --paned, --plug) with GDK_BACKEND=x11 on Wayland'
    
      17)
    
      18source=("https://ftp.altlinux.org/pub/distributions/ALTLinux/Sisyphus/files/SRPMS/${_pkgname}-${pkgver}-alt1.src.rpm"
    
      19        'yad-settings'
    
      20        'wayland.en.txt'
    
      21        'wayland.ru.txt')
    
      22sha256sums=('7106e790dac1ef39cda18b6bd64c803bc8cd46b475473decba6cb4e5239fed49'
    
      23            'cade839df31924b33d8cfec7c1c5174f7eea41496cf1358472996cef427a9a0a'
    
      24            '48fbfb554f3e982f953811dbedcd1ebf5228bff71de88a50e1dfe7532e015296'
    
      25            '4fd9fd005335d3d0bcd45d4e4fccadcddb1de967203436eeaeb73318d3695903')
    
      26replaces=('yad')
    
      27provides=('yad')
    
      28conflicts=('yad' 'yad-git' 'yad-gtk2')
    
      29
    
      30prepare() {
    
      31  tar -xf "v${pkgver}.tar.gz"
    
      32  cd "${srcdir}/${_pkgname}-${pkgver}"
    
      33  cp ../ru.po po && echo ru >> po/LINGUAS
    
      34  # Typo in ALT's translation turns this checkbox into a text field
    
      35  sed -i 's/текущую строку;CHK/текущую строку:CHK/' po/ru.po
    
      36  patch -Np1 -i ../show-cursor-initially.patch
    
      37
    
      38  autoreconf -ivf
    
      39}
    
      40
    
      41build() {
    
      42  cd "${srcdir}/${_pkgname}-${pkgver}"
    
      43
    
      44  # Disabled to keep gtk3 as the only runtime dependency. These are build-time
    
      45  # switches: enabling one requires the library in makedepends and depends.
    
      46  #   --enable-html          webkit2gtk-4.1           --html dialog
    
      47  #   --enable-appindicator  libayatana-appindicator  --indicator (SNI tray, works on Wayland)
    
      48  #   --enable-spell         gspell                   spell checking
    
      49  #   --enable-sourceview    gtksourceview3           syntax highlighting in --text-info,
    
      50  #                                                   yad-settings "Editor" section
    
      51  ./configure \
    
      52    --prefix=/usr \
    
      53    --enable-icon-browser \
    
      54    --disable-html \
    
      55--enable-appindicator \
    
      56    --disable-spell \
    
      57    --disable-sourceview
    
      58
    
      59  make
    
      60}
    
      61
    
      62package() {
    
      63  cd "${srcdir}/${_pkgname}-${pkgver}"
    
      64
    
      65  make DESTDIR="${pkgdir}" install
    
      66
    
      67  # The upstream editor needs X11; the wrapper picks it or the Wayland version.
    
      68  mv "${pkgdir}/usr/bin/yad-settings" "${pkgdir}/usr/bin/yad-settings-x11"
    
      69  install -Dm755 "${srcdir}/yad-settings" "${pkgdir}/usr/bin/yad-settings"
    
      70  # Read by yad-settings; kept outside /usr/share/doc so !docs/NoExtract cannot drop them.
    
      71  install -Dm644 -t "${pkgdir}/usr/share/${pkgname}" "${srcdir}"/wayland.{en,ru}.txt
    
      72}
    
      73

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2