The Void source packages collection
This report summarizes scanner evidence for void-linux/void-packages, a Shell project with 3,484 GitHub stars. SynthScan examined 28,971 lines of code across 400 source files, recording 80 pattern matches distributed across 11 syntactic categories. The legacy adjusted pattern signal is 3.9 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 75 finding(s).
Are imports declared and package/API names verified? 2 finding(s).
Are wrappers, guards, and repeated structures necessary? 4 finding(s).
Which changes need focused human review? 80 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 80 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | srcpkgs/firefox/files/stab.h | 41 | * the N_STAB mask set. | COMMENT |
| LOW | srcpkgs/firefox/files/stab.h | 61 | #define N_EINCL 0xa2 /* include file end */ | COMMENT |
| LOW | srcpkgs/gmime/files/iconv-detect.h | 1 | /* This is an auto-generated header, DO NOT EDIT! */ | COMMENT |
| LOW | srcpkgs/gmime/files/musl-iconv-detect.h | 1 | /* This is an auto-generated header, DO NOT EDIT! */ | COMMENT |
| LOW | srcpkgs/trn/files/Policy.sh | 1 | #!/bin/sh | COMMENT |
| LOW | srcpkgs/trn/files/Policy.sh | 21 | COMMENT | |
| LOW | srcpkgs/trn/files/Policy.sh | 81 | # multistate region distribution name | COMMENT |
| LOW | srcpkgs/trn/files/Policy.sh | 101 | newslib='/tmp' | COMMENT |
| LOW | srcpkgs/musl/files/getent.c | 41 | #include <stdbool.h> | COMMENT |
| LOW | srcpkgs/llvm18/files/llvm-Config-llvm-config.h | 1 | #include <bits/wordsize.h> | COMMENT |
| LOW | srcpkgs/llvm19/files/llvm-Config-llvm-config.h | 1 | #include <bits/wordsize.h> | COMMENT |
| LOW | srcpkgs/mdocml/files/cgi.h | 1 | #define SCRIPT_NAME "" | COMMENT |
| LOW | srcpkgs/llvm21/files/llvm-Config-llvm-config.h | 1 | #include <bits/wordsize.h> | COMMENT |
| LOW | srcpkgs/openbsd-netcat/files/base64.c | 41 | */ | COMMENT |
| LOW | srcpkgs/perl/files/update-perl-provides.pl | 1 | #!/usr/bin/perl | COMMENT |
| LOW | srcpkgs/signify/files/void.h | 1 | #ifndef __GLIBC__ | COMMENT |
| LOW | srcpkgs/qt5-webengine/files/sndio-files/sndio_input.h | 1 | // Copyright 2013 The Chromium Authors. All rights reserved. | COMMENT |
| LOW | srcpkgs/qt5-webengine/files/sndio-files/sndio_output.h | 1 | // Copyright (c) 2012 The Chromium Authors. All rights reserved. | COMMENT |
| LOW | …t5-webengine/files/sndio-files/audio_manager_openbsd.h | 1 | // Copyright (c) 2012 The Chromium Authors. All rights reserved. | COMMENT |
| LOW | srcpkgs/python3-numpy/files/fenv-constants.h | 1 | #define FE_INVALID 1 | COMMENT |
| LOW | srcpkgs/musl1.1/files/getent.c | 41 | #include <stdbool.h> | COMMENT |
| LOW | srcpkgs/firefox-esr/files/stab.h | 41 | * the N_STAB mask set. | COMMENT |
| LOW | srcpkgs/firefox-esr/files/stab.h | 61 | #define N_EINCL 0xa2 /* include file end */ | COMMENT |
| LOW | srcpkgs/llvm23/files/llvm-Config-llvm-config.h | 1 | #include <bits/wordsize.h> | COMMENT |
| LOW | srcpkgs/musl-legacy-compat/files/cdefs.h | 1 | #ifndef _SYS_CDEFS_H_ | COMMENT |
| LOW | srcpkgs/musl-legacy-compat/files/cdefs.h | 21 | #endif | COMMENT |
| LOW | srcpkgs/llvm22/files/llvm-Config-llvm-config.h | 1 | #include <bits/wordsize.h> | COMMENT |
| LOW | srcpkgs/fdm/files/base64.c | 41 | */ | COMMENT |
| LOW | srcpkgs/ifenslave/files/ifenslave.c | 141 | "\n" | COMMENT |
| LOW | srcpkgs/rpi-firmware/files/config.txt | 1 | # uncomment if you get no picture on HDMI for a default "safe" mode | COMMENT |
| LOW | srcpkgs/rpi-firmware/files/config.txt | 21 | #hdmi_force_hotplug=1 | COMMENT |
| LOW | srcpkgs/rpi-firmware/files/config.txt | 41 | # for more options see http://elinux.org/RPi_config.txt | COMMENT |
| LOW | srcpkgs/rpi-firmware/files/config.txt | 61 | #over_voltage=2 | COMMENT |
| LOW | srcpkgs/thunderbird/files/stab.h | 41 | * the N_STAB mask set. | COMMENT |
| LOW | srcpkgs/thunderbird/files/stab.h | 61 | #define N_EINCL 0xa2 /* include file end */ | COMMENT |
| LOW | srcpkgs/freepats/files/timidity-freepats.cfg | 1 | ## Load the patchset from freepats | COMMENT |
| LOW | srcpkgs/freepats/files/timidity-freepats.cfg | 21 | #opt s32kHz | COMMENT |
| LOW | common/chroot-style/ethereal.sh | 1 | #!/bin/sh | COMMENT |
| LOW | common/xbps-src/shutils/build_dependencies.sh | 41 | fi | COMMENT |
| LOW | common/build-style/void-cross.sh | 1 | # | COMMENT |
| LOW | common/build-style/perl-module.sh | 1 | # | COMMENT |
| LOW | common/build-style/perl-ModuleBuild.sh | 1 | # | COMMENT |
| LOW | common/build-style/slashpackage.sh | 1 | # | COMMENT |
| LOW | common/build-style/sip-build.sh | 81 | HostLibraries=/usr/lib | COMMENT |
| LOW | common/build-helper/gir.sh | 1 | # | COMMENT |
| LOW | …/hooks/post-install/04-create-xbps-metadata-scripts.sh | 21 | install) ;; | COMMENT |
| LOW | …/hooks/post-install/04-create-xbps-metadata-scripts.sh | 241 | _add_trigger gtk-immodules | COMMENT |
| LOW | common/hooks/post-install/80-prepare-32bit.sh | 1 | # This hook creates a new PKGDESTDIR with 32bit files for x86_64. | COMMENT |
| LOW | common/environment/fetch/fetch_cmd.sh | 1 | # | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | srcpkgs/nix/files/nix.sh | 27 | # Create the per-user garbage collector roots directory. | COMMENT |
| MEDIUM | srcpkgs/perl/files/update-perl-provides.pl | 47 | ## Create a path like $path/lib/Foo/Bar.pm for Foo::Bar. | COMMENT |
| MEDIUM | srcpkgs/perl/files/update-perl-provides.pl | 55 | ## Create a path to a file in the containing directory, named after | COMMENT |
| MEDIUM | common/xbps-src/shutils/cross.sh | 76 | # Create a sysroot/include and sysroot/lib symlink just in case. | COMMENT |
| MEDIUM | common/build-style/gemspec.sh | 68 | # Create a backup which we will restore later | COMMENT |
| MEDIUM | common/hooks/do-pkg/00-gen-pkg.sh | 66 | # Create the XBPS binary package. | COMMENT |
| MEDIUM | …/hooks/post-install/04-create-xbps-metadata-scripts.sh | 55 | # The following code will run the triggers. | COMMENT |
| MEDIUM | common/hooks/do-fetch/00-distfiles.sh | 218 | # Create a map from target file to index in _distfiles/_checksums | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | common/xbps-src/shutils/common.sh | 487 | # Check if required vars weren't set. | COMMENT |
| LOW⚡ | common/xbps-src/shutils/common.sh | 496 | # Check if version is valid. | COMMENT |
| LOW⚡ | common/xbps-src/shutils/common.sh | 506 | # Check if base-chroot is already installed. | COMMENT |
| LOW⚡ | common/xbps-src/shutils/cross.sh | 42 | # Check if the cross pkg is installed in host. | COMMENT |
| LOW⚡ | common/xbps-src/shutils/cross.sh | 46 | # Check if the cross compiler pkg is available in repos, otherwise build it. | COMMENT |
| LOW⚡ | common/xbps-src/shutils/cross.sh | 53 | # Check if cross-vpkg-dummy is installed. | COMMENT |
| LOW | common/xbps-src/shutils/cross.sh | 90 | # Check if installed. | COMMENT |
| LOW | common/xbps-src/shutils/cross.sh | 94 | # Check if the cross compiler pkg is available in repos, otherwise build it. | COMMENT |
| LOW | common/xbps-src/shutils/bulk.sh | 17 | # Iterate over the list and make sure that only real pkgs are | COMMENT |
| LOW | common/build-style/go.sh | 40 | # Check if go_import_path matches module | COMMENT |
| LOW | common/build-helper/gir.sh | 8 | # Check if the 'gir' build_option is set or if there is no | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | common/scripts/xbps-cycles.py | 33 | except FileNotFoundError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | common/chroot-style/ethereal.sh | 53 | # to the base location then just return 0 | COMMENT |
| LOW | common/environment/build-style/go.sh | 15 | # target compiler to use; otherwise it'll just call gccgo | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | common/build-style/python3-module.sh | 19 | # Fall back to deprecated setup.py test orchestration without pytest | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | srcpkgs/backblaze-b2/files/test_b2_command_line.py | 103 | except Exception as e: | STRING |
| MEDIUM | srcpkgs/backblaze-b2/files/test_b2_command_line.py | 100 | def read_from(self, f): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | srcpkgs/backblaze-b2/files/test_b2_command_line.py | 12 | CODE | |
| LOW | common/scripts/xbps-cycles.py | 4 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | common/scripts/xbps-cycles.py | 14 | CODE | |
| LOW | common/scripts/parse-py-metadata.py | 113 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | srcpkgs/perl/files/update-perl-provides.pl | 15 | ## Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | srcpkgs/backblaze-b2/files/test_b2_command_line.py | 108 | def remove_insecure_platform_warnings(text): | STRING |