yutovo

LOW
maintainer denprog 0 votes scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The package builds from multiple source repositories, including the project's own and well-known upstreams; most sources are git checkouts or official releases, and the non-whitelisted hosts (e.g. univ-grenoble-alpes.fr, boost.io) are plausible project hosts; skipped checksums are a quality issue but do not imply malicious intent as all sources are used to build the software, not executed directly.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from multiple source repositories, including the project's own and well-known upstreams; most sources are git checkouts or official releases, and the non-whitelisted hosts (e.g. univ-grenoble-alpes.fr, boost.io) are plausible project hosts; skipped checksums are a quality issue but do not imply malicious intent as all sources are used to build the software, not executed directly.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:17 "boost_1_92_0::https://archives.boost.io/release/1.92.0/source/boost_1_92_0.zip"
  • PKGBUILD:18 "giac_stable.tgz::https://www-fourier.univ-grenoble-alpes.fr/~parisse/giac/giac_stable.tgz"

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: Denis Gordenin <support@yutovo.ru>
2pkgname=yutovo
3pkgver=1.8.1
4pkgrel=2
5pkgdesc="Arbitrary precision graphical WYSIWYG calculator inside a text editor"
6arch=(x86_64)
7url="https://yutovo.com"
8license=(GPL-3.0-only)
9
10depends=('hicolor-icon-theme' 'qt5-base' 'zlib' 'fontconfig' 'glibc' 'gcc-libs' 'libpng' 'gmp' 'mpfr' 'ttf-dejavu' 'gnu-free-fonts')
11
12makedepends=('git' 'cmake' 'base-devel' 'qt5-base' 'qt5-tools')
13
14source=(
15 "spdlog::git+https://github.com/gabime/spdlog.git#tag=v1.15.3"
16 "yutovo-logger::git+https://github.com/denprog/yutovo-logger.git#tag=v1.0.8"
17 "boost_1_92_0::https://archives.boost.io/release/1.92.0/source/boost_1_92_0.zip"
18 "giac_stable.tgz::https://www-fourier.univ-grenoble-alpes.fr/~parisse/giac/giac_stable.tgz"
19 "yutovo-calculator::git+https://github.com/denprog/yutovo-calculator.git#tag=v1.7.1"
20 "rapidjson::git+https://github.com/Tencent/rapidjson.git#tag=v1.1.0"
21 "yutovo-solver::git+https://github.com/denprog/yutovo-solver.git#tag=v1.4.1"
22 "mathgl-8.0.3.tar.gz::https://downloads.sourceforge.net/mathgl/mathgl-8.0.3.tar.gz"
23 "libharu::git+https://github.com/libharu/libharu.git#tag=v2.4.4"
24 "stb_image.h::https://raw.githubusercontent.com/nothings/stb/master/stb_image.h"
25 "stb_image_write.h::https://raw.githubusercontent.com/nothings/stb/master/stb_image_write.h"
26 "yutovo-editor::git+https://github.com/denprog/yutovo-editor.git#tag=v1.8.1"
27 "yutovo-library::git+https://github.com/denprog/yutovo-library.git#tag=v1.2.1"
28 "yutovo-desktop::git+https://github.com/denprog/yutovo-desktop.git#tag=v1.8.1"
29)
30
31sha256sums=(
32 'SKIP'
33 'SKIP'
34 'SKIP'
35 '3e7fa1c281a21ab74ed66ef247faffe5a105bc11be1f7715f31b4368ce8dcbc8'
36 'SKIP'
37 'SKIP'
38 'SKIP'
39 'SKIP'
40 'SKIP'
41 'SKIP'
42 'SKIP'
43 'SKIP'
44 'SKIP'
45 'SKIP'
46)
47
48prepare() {
49 mkdir -p deploy/lib
50 export YUTOVO_DEPLOY=$PWD/deploy
51}
52
53build() {
54 echo "Building spdlog"
55 cd spdlog
56 mkdir -p build && cd build
57 cmake -DCMAKE_BUILD_TYPE=Release -DSPDLOG_BUILD_TESTS=OFF -DCMAKE_INSTALL_PREFIX=$YUTOVO_DEPLOY ..
58 make -sj4 && make install
59 cd ../..
60
61 echo "Building yutovo-logger"
62 cd yutovo-logger
63 mkdir -p build && cd build
64 cmake -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=$YUTOVO_DEPLOY ..
65 make -sj4 && make install
66 cd ../..
67
68 echo "Building boost"
69 cd boost_1_92_0
70 unset CFLAGS CXXFLAGS LDFLAGS
71 ./bootstrap.sh --prefix=$YUTOVO_DEPLOY
72 ./b2 headers
73 # boost::process v2 (used by yutovo-solver) is a compiled library since 1.86
74 ./b2 -q -j4 --with-process link=static threading=multi cxxstd=17
75 ./b2 -j4 --with-process link=static threading=multi cxxstd=17 install
76 cp -r boost $YUTOVO_DEPLOY/include/
77 cd ..
78
79 echo "Building giac"
80 cd giac-2.0.0
81 patch -Np1 --forward -i "$srcdir/yutovo-desktop/setup/Snap/snap/giac_config_h.diff"
82 GIAC_BUILD_JOBS=4 bash "$srcdir/yutovo-desktop/setup/Snap/snap/build_giac.sh" "$srcdir/giac-2.0.0" "$YUTOVO_DEPLOY"
83 cd ..
84 export LIBRARY_PATH=$YUTOVO_DEPLOY/lib
85
86 echo "Building yutovo-calculator"
87 cd yutovo-calculator
88 mkdir -p build && cd build
89 cmake -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTS=OFF -DCMAKE_INSTALL_PREFIX=$YUTOVO_DEPLOY ..
90 make -sj4 && make install
91 cd ../..
92
93 echo "Building rapidjson"
94 cd rapidjson
95 patch -Np1 -i "$srcdir/yutovo-desktop/setup/document.h.diff"
96 cp -r include/rapidjson "$YUTOVO_DEPLOY/include/"
97 cd ..
98
99 echo "Building yutovo-solver"
100 cd yutovo-solver
101 mkdir -p build && cd build
102 cmake -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTS=OFF -DCMAKE_POLICY_DEFAULT_CMP0167=NEW -DCMAKE_PREFIX_PATH=$YUTOVO_DEPLOY/lib/cmake -DCMAKE_INSTALL_PREFIX=$YUTOVO_DEPLOY ..
103 make -sj4 && make install
104 cd ../..
105
106 echo "Building mathgl"
107 cd mathgl-8.0.3
108 mkdir -p build && cd build
109 cmake -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_LIBDIR=$YUTOVO_DEPLOY -Denable-openmp=False -Denable-png=False -Denable-opengl=False -DCMAKE_INSTALL_PREFIX=$YUTOVO_DEPLOY ..
110 make -sj4 && make install
111 cd ../..
112
113 echo "Building libharu"
114 cd libharu
115 mkdir -p build && cd build
116 cmake -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=OFF -DCMAKE_INSTALL_PREFIX=$YUTOVO_DEPLOY ..
117 make -sj4 && make install
118 cd ../..
119
120 mkdir -p $YUTOVO_DEPLOY/../third-party/stb_image
121 cp stb_image.h $YUTOVO_DEPLOY/../third-party/stb_image/
122 cp stb_image_write.h $YUTOVO_DEPLOY/../third-party/stb_image/
123
124 echo "Building yutovo-editor"
125 cd yutovo-editor
126 mkdir -p build && cd build
127 cmake -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTS=OFF -DCMAKE_INSTALL_PREFIX=$YUTOVO_DEPLOY ..
128 make -sj4 && make install
129 cd ../..
130
131 echo "Building yutovo-library"
132 cd yutovo-library
133 mkdir -p $YUTOVO_DEPLOY/bin
134 ./make_library.sh $YUTOVO_DEPLOY/bin ZIP
135 cd ..
136
137 echo "Building yutovo-desktop"
138 cd yutovo-desktop
139 mkdir -p build && cd build
140 cmake -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTS=OFF -DCMAKE_INSTALL_PREFIX=$YUTOVO_DEPLOY ..
141 make -sj4 && make install
142 cd ../..
143}
144
145package() {
146 echo "package"
147 mkdir -p $pkgdir/usr/bin
148 mkdir -p $pkgdir/usr/share/icons/hicolor/16x16/apps
149 mkdir -p $pkgdir/usr/share/icons/hicolor/32x32/apps
150 mkdir -p $pkgdir/usr/share/icons/hicolor/64x64/apps
151 mkdir -p $pkgdir/usr/share/icons/hicolor/256x256/apps
152 mkdir -p $pkgdir/usr/share/icons/hicolor/256x256/mimetypes
153 mkdir -p $pkgdir/usr/share/applications/
154 mkdir -p $pkgdir/usr/share/mime/packages/
155 mkdir -p $pkgdir/usr/share/metainfo/
156 mkdir -p $pkgdir/usr/share/yutovo/translations/
157
158 cp $YUTOVO_DEPLOY/bin/yutovo-desktop $pkgdir/usr/bin/
159 cp $YUTOVO_DEPLOY/bin/yutovo-solver-calculator-worker $pkgdir/usr/bin/
160 cp -r $srcdir/yutovo-desktop/build/src/*.qm $pkgdir/usr/share/yutovo/translations/
161 cp -r $YUTOVO_DEPLOY/bin/library $pkgdir/usr/share/yutovo/
162 cp $srcdir/yutovo-desktop/setup/Arch/run.sh $pkgdir/usr/bin/yutovo
163 cp $srcdir/yutovo-desktop/setup/yutovo-16.png $pkgdir/usr/share/icons/hicolor/16x16/apps/yutovo.png
164 cp $srcdir/yutovo-desktop/setup/yutovo-32.png $pkgdir/usr/share/icons/hicolor/32x32/apps/yutovo.png
165 cp $srcdir/yutovo-desktop/setup/yutovo-64.png $pkgdir/usr/share/icons/hicolor/64x64/apps/yutovo.png
166 cp $srcdir/yutovo-desktop/src/images/mainicon.png $pkgdir/usr/share/icons/hicolor/256x256/apps/yutovo.png
167 cp $srcdir/yutovo-desktop/src/images/mainicon.png $pkgdir/usr/share/icons/hicolor/256x256/mimetypes/application-x-yut.png
168
169 chmod g-w $pkgdir/usr/bin/yutovo-desktop
170 chmod o-w $pkgdir/usr/bin/yutovo-desktop
171 chmod g-w $pkgdir/usr/bin/yutovo-solver-calculator-worker
172 chmod o-w $pkgdir/usr/bin/yutovo-solver-calculator-worker
173 chmod +x $pkgdir/usr/bin/yutovo
174 chmod -R -w $pkgdir/usr/share/yutovo/library
175
176 cp $srcdir/yutovo-desktop/setup/Arch/yutovo.desktop $pkgdir/usr/share/applications/
177 cp $srcdir/yutovo-desktop/setup/yutovo.xml $pkgdir/usr/share/mime/packages/
178 cp $srcdir/yutovo-desktop/setup/com.yutovo.yutovo.metainfo.xml $pkgdir/usr/share/metainfo/
179}
180

Changes since previous scan

--- PKGBUILD @ 2026-10-24 00:14
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
# Maintainer: Denis Gordenin <support@yutovo.ru>
pkgname=yutovo
-pkgver=1.7.1
-pkgrel=3
+pkgver=1.8.1
+pkgrel=2
pkgdesc="Arbitrary precision graphical WYSIWYG calculator inside a text editor"
arch=(x86_64)
url="https://yutovo.com"
@@ -13,19 +13,19 @@
source=(
"spdlog::git+https://github.com/gabime/spdlog.git#tag=v1.15.3"
- "yutovo-logger::git+https://github.com/denprog/yutovo-logger.git#tag=v1.0.6"
- "boost_1_83_0::https://archives.boost.io/release/1.83.0/source/boost_1_83_0.zip"
+ "yutovo-logger::git+https://github.com/denprog/yutovo-logger.git#tag=v1.0.8"
+ "boost_1_92_0::https://archives.boost.io/release/1.92.0/source/boost_1_92_0.zip"
"giac_stable.tgz::https://www-fourier.univ-grenoble-alpes.fr/~parisse/giac/giac_stable.tgz"
- "yutovo-calculator::git+https://github.com/denprog/yutovo-calculator.git#tag=v1.6.1"
+ "yutovo-calculator::git+https://github.com/denprog/yutovo-calculator.git#tag=v1.7.1"
"rapidjson::git+https://github.com/Tencent/rapidjson.git#tag=v1.1.0"
- "yutovo-solver::git+https://github.com/denprog/yutovo-solver.git#tag=v1.3.1"
+ "yutovo-solver::git+https://github.com/denprog/yutovo-solver.git#tag=v1.4.1"
"mathgl-8.0.3.tar.gz::https://downloads.sourceforge.net/mathgl/mathgl-8.0.3.tar.gz"
"libharu::git+https://github.com/libharu/libharu.git#tag=v2.4.4"
"stb_image.h::https://raw.githubusercontent.com/nothings/stb/master/stb_image.h"
"stb_image_write.h::https://raw.githubusercontent.com/nothings/stb/master/stb_image_write.h"
- "yutovo-editor::git+https://github.com/denprog/yutovo-editor.git#tag=v1.7.1"
- "yutovo-library::git+https://github.com/denprog/yutovo-library.git#tag=v1.1.1"
- "yutovo-desktop::git+https://github.com/denprog/yutovo-desktop.git#tag=v1.7.1"
+ "yutovo-editor::git+https://github.com/denprog/yutovo-editor.git#tag=v1.8.1"
+ "yutovo-library::git+https://github.com/denprog/yutovo-library.git#tag=v1.2.1"
+ "yutovo-desktop::git+https://github.com/denprog/yutovo-desktop.git#tag=v1.8.1"
)
sha256sums=(
@@ -66,10 +66,13 @@
cd ../..
echo "Building boost"
- cd boost_1_83_0
+ cd boost_1_92_0
unset CFLAGS CXXFLAGS LDFLAGS
./bootstrap.sh --prefix=$YUTOVO_DEPLOY
./b2 headers
+ # boost::process v2 (used by yutovo-solver) is a compiled library since 1.86
+ ./b2 -q -j4 --with-process link=static threading=multi cxxstd=17
+ ./b2 -j4 --with-process link=static threading=multi cxxstd=17 install
cp -r boost $YUTOVO_DEPLOY/include/
cd ..
@@ -96,7 +99,7 @@
echo "Building yutovo-solver"
cd yutovo-solver
mkdir -p build && cd build
- cmake -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTS=OFF -DCMAKE_PREFIX_PATH=$YUTOVO_DEPLOY/lib/cmake -DCMAKE_INSTALL_PREFIX=$YUTOVO_DEPLOY ..
+ cmake -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTS=OFF -DCMAKE_POLICY_DEFAULT_CMP0167=NEW -DCMAKE_PREFIX_PATH=$YUTOVO_DEPLOY/lib/cmake -DCMAKE_INSTALL_PREFIX=$YUTOVO_DEPLOY ..
make -sj4 && make install
cd ../..

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Low 2
2026-10-31 00:07:41 Low 2
2026-10-30 00:29:30 Low 2
2026-10-29 00:13:55 Low 2
2026-10-28 00:06:54 Low 2
2026-10-27 00:23:28 Low 2
2026-10-26 00:12:40 Low 2
2026-10-25 00:20:48 Low 2
2026-10-24 07:39:45 Medium 1
2026-10-24 00:14:55 Low 2
2026-10-23 00:02:19 Low 2
2026-10-22 00:13:10 Low 2
2026-10-21 00:12:50 Low 2
2026-10-20 00:10:31 Low 2
2026-10-19 00:03:55 Low 2
2026-10-18 00:06:55 Low 2
2026-10-17 00:21:55 Low 2
2026-10-16 00:12:47 Low 2
2026-10-15 00:28:05 Low 2
2026-10-14 00:06:47 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion