yadqt-git

maintainer kekmacska · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged Package builds from its own GitHub source with SKIP'd checksum, but source is public and verifiable; build uses aggressive optimizations but no remote code execution or malicious behavior; low risk due to transparency and lack of executed payloads.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): Package builds from its own GitHub source with SKIP'd checksum, but source is public and verifiable; build uses aggressive optimizations but no remote code execution or malicious behavior; low risk due to transparency and lack of executed payloads.

PKGBUILD

      1# Maintainer: kekmacska
    
      2
    
      3_srcname=YadQt
    
      4pkgname=yadqt-git
    
      5pkgver=0
    
      6pkgrel=1
    
      7pkgdesc='Produce simple Qt dialogs from the command line, similar to YAD for gtk'
    
      8arch=('any')
    
      9license=('GPL-3.0')
    
      10url='https://keithdhedger.github.io/pages/yadqt/yadqt.html'
    
      11source=('git+https://github.com/KeithDHedger/YadQt.git')
    
      12makedepends=(make autoconf oxipng)
    
      13depends=(qt6-base)
    
      14provides=(yadqt)
    
      15sha256sums=('SKIP')
    
      16
    
      17pkgver() {
    
      18  cd $_srcname
    
      19  git describe --long --tags | sed -r 's/([^-]*-g)/r\1/;s/-/./g;s/v//g'
    
      20}
    
      21
    
      22prepare() {
    
      23    cd "$srcdir/$_srcname"
    
      24    oxipng -o max -r -p -s -v -t $(nproc) -z --zi 100 --ziwi 10 --brute-level 5 --brute-lines 16 .
    
      25}
    
      26
    
      27build() {
    
      28    cd $_srcname
    
      29
    
      30    BASE_CFLAGS="-O3 -march=native -mtune=native \
    
      31            -falign-functions=32 -falign-loops=32 \
    
      32            -fno-math-errno -fno-trapping-math \
    
      33            -fno-semantic-interposition \
    
      34            -fomit-frame-pointer -fno-plt \
    
      35            -pipe -flto -Wall -Wno-unused \
    
      36            -fstrict-aliasing -fno-rtti -fno-exceptions \
    
      37            -fmerge-all-constants -ffunction-sections \
    
      38            -fdata-sections -fvisibility=hidden"
    
      39
    
      40    BASE_CXXFLAGS="$BASE_CFLAGS"
    
      41    BASE_LDFLAGS="-Wl,--icf=safe -Wl,--gc-sections -flto -fno-plt"
    
      42
    
      43    # Clang-only flags
    
      44    CLANG_EXTRA_CFLAGS="-fstrict-vtable-pointers -fno-asynchronous-unwind-tables"
    
      45    CLANG_EXTRA_CXXFLAGS="$CLANG_EXTRA_CFLAGS"
    
      46    CLANG_EXTRA_LDFLAGS="-fuse-ld=lld"
    
      47
    
      48    # Detect compiler
    
      49    if command -v clang >/dev/null 2>&1; then
    
      50        export CC=clang
    
      51        export CXX=clang++
    
      52        export CFLAGS="$BASE_CFLAGS $CLANG_EXTRA_CFLAGS"
    
      53        export CXXFLAGS="$BASE_CXXFLAGS $CLANG_EXTRA_CXXFLAGS"
    
      54        export LDFLAGS="$BASE_LDFLAGS $CLANG_EXTRA_LDFLAGS"
    
      55    else
    
      56        export CC=gcc
    
      57        export CXX=g++
    
      58        export CFLAGS="$BASE_CFLAGS"
    
      59        export CXXFLAGS="$BASE_CXXFLAGS"
    
      60        export LDFLAGS="$BASE_LDFLAGS"
    
      61    fi
    
      62
    
      63    sh autogen.sh --prefix=/usr && make -j$(nproc)
    
      64}
    
      65
    
      66package() {
    
      67    cd $_srcname
    
      68    make DESTDIR="$pkgdir" install
    
      69}
    
      70

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 15:36:47	LOW	2