alise-git

LOW

maintainer mipi 0 votes scanned 2026-09-22 07:39:05.601057

View on AUR

Why flagged

Builds from the project's own Codeberg git repository (codeberg.org/mipi/alise), which is a normal VCS source for an AUR -git package; SKIP on a git clone is standard practice and poses no meaningful supply-chain risk beyond the usual trust in the upstream repo.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 85%): Builds from the project's own Codeberg git repository (codeberg.org/mipi/alise), which is a normal VCS source for an AUR -git package; SKIP on a git clone is standard practice and poses no meaningful supply-chain risk beyond the usual trust in the upstream repo.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("git+https://$_pkgorg/$_pkgname.git")

PKGBUILD

1 offending line(s) highlighted

      1# SPDX-FileCopyrightText: 2026 Michael Picht <mipi@fsfe.org>
    
      2#
    
      3# SPDX-License-Identifier: GPL-3.0-or-later
    
      4
    
      5# Maintainer: Michael Picht <mipi@fsfe.org>
    
      6
    
      7_pkgorg=codeberg.org/mipi
    
      8_pkgname=alise
    
      9pkgname=${_pkgname}-git
    
      10pkgver=0.1.0.r0.gb2e0f6d
    
      11pkgrel=1
    
      12pkgdesc="Declarative Arch Linux installer in Guile Scheme"
    
      13arch=(any)
    
      14url="https://${_pkgorg}/${_pkgname}/"
    
      15license=(GPL-3.0-or-later)
    
      16source=("git+https://$_pkgorg/$_pkgname.git")
    
      17md5sums=('SKIP')
    
      18provides=(alise)
    
      19conflicts=(alise)
    
      20depends=(
    
      21  guile
    
      22  guile-ssh
    
      23)
    
      24makedepends=(
    
      25  git
    
      26  make
    
      27)
    
      28
    
      29pkgver() {
    
      30  cd "$_pkgname" || return
    
      31  (
    
      32    set -o pipefail
    
      33    git describe --tags --long 2>/dev/null |
    
      34      sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/^v//' |
    
      35      tr -d '\n' ||
    
      36      printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      37  )
    
      38}
    
      39
    
      40package() {
    
      41  cd "$_pkgname" || return
    
      42  make DESTDIR="$pkgdir" install
    
      43}
    
      44

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-22 07:39:05	Low	3
2026-09-22 07:37:25	Medium	2