ampcode

maintainer lapsus · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads prebuilt binaries from a non-standard host (static.ampcode.com), which is not on the standard whitelist, posing a supply-chain risk if the host were compromised or the binaries swapped.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:24 curl -fsS https://static.ampcode.com/cli/cli-version.txt | tr '-' '_'

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source_x86_64=("${pkgname}-${pkgver}-x64::https://static.ampcode.com/cli/${_amp_ver}/amp-linux-x64")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads prebuilt binaries from a non-standard host (static.ampcode.com), which is not on the standard whitelist, posing a supply-chain risk if the host were compromised or the binaries swapped.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Yakov Till <yakov.till@gmail.com>
    
      2
    
      3pkgname=ampcode
    
      4pkgver=0.0.1785488326_gdfd462
    
      5pkgrel=1
    
      6pkgdesc="Amp CLI — Sourcegraph's agentic coding tool"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://ampcode.com"
    
      9license=('LicenseRef-proprietary')
    
      10depends=('glibc')
    
      11optdepends=('ripgrep: faster file search (amp downloads its own if missing)')
    
      12options=('!strip' '!debug')
    
      13provides=('amp')
    
      14conflicts=('amp' 'ampcode-bin')
    
      15replaces=('sourcegraph-amp')
    
      16
    
      17_amp_ver=${pkgver//_/-}
    
      18source_x86_64=("${pkgname}-${pkgver}-x64::https://static.ampcode.com/cli/${_amp_ver}/amp-linux-x64")
    
      19source_aarch64=("${pkgname}-${pkgver}-arm64::https://static.ampcode.com/cli/${_amp_ver}/amp-linux-arm64")
    
      20sha256sums_x86_64=('f09df6866bc5677bba7377329bd5fb8966288749021561681b7af4c63e8f5fff')
    
      21sha256sums_aarch64=('85dc222d12d19e57b2bd89f66e388f0227afa559bccb3c8d9eba807c6f28ff4a')
    
      22
    
      23latestver() {
    
      24    curl -fsS https://static.ampcode.com/cli/cli-version.txt | tr '-' '_'
    
      25}
    
      26
    
      27package() {
    
      28    case "${CARCH}" in
    
      29        x86_64)  install -Dm755 "${srcdir}/${pkgname}-${pkgver}-x64"   "${pkgdir}/usr/bin/amp" ;;
    
      30        aarch64) install -Dm755 "${srcdir}/${pkgname}-${pkgver}-arm64" "${pkgdir}/usr/bin/amp" ;;
    
      31    esac
    
      32}
    
      33

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: Yakov Till <yakov.till@gmail.com>
 
 pkgname=ampcode
-pkgver=0.0.1785414570_ga1c034
+pkgver=0.0.1785488326_gdfd462
 pkgrel=1
 pkgdesc="Amp CLI — Sourcegraph's agentic coding tool"
 arch=('x86_64' 'aarch64')
@@ -17,8 +17,8 @@
 _amp_ver=${pkgver//_/-}
 source_x86_64=("${pkgname}-${pkgver}-x64::https://static.ampcode.com/cli/${_amp_ver}/amp-linux-x64")
 source_aarch64=("${pkgname}-${pkgver}-arm64::https://static.ampcode.com/cli/${_amp_ver}/amp-linux-arm64")
-sha256sums_x86_64=('095d2c6c8daeb82bd1b978e1fb069d29df946bef4d5bc2605b9ca45babe204bf')
-sha256sums_aarch64=('50aac57bfdcfab45e5a464b0df8e69cfbc5c583b454b047bbaa4492de4da005f')
+sha256sums_x86_64=('f09df6866bc5677bba7377329bd5fb8966288749021561681b7af4c63e8f5fff')
+sha256sums_aarch64=('85dc222d12d19e57b2bd89f66e388f0227afa559bccb3c8d9eba807c6f28ff4a')
 
 latestver() {
     curl -fsS https://static.ampcode.com/cli/cli-version.txt | tr '-' '_'

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 17:18:23	MEDIUM	3
2026-07-31 13:18:10	MEDIUM	3
2026-07-31 00:14:10	LOW	3
2026-07-30 23:17:02	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	2
2026-07-30 11:14:12	MEDIUM	2
2026-07-30 00:17:23	LOW	3
2026-07-29 23:13:22	MEDIUM	2
2026-07-29 15:12:02	MEDIUM	2
2026-07-29 13:11:48	MEDIUM	2
2026-07-29 00:25:53	LOW	3
2026-07-28 17:39:33	MEDIUM	2
2026-07-28 13:38:59	MEDIUM	3
2026-07-28 01:36:52	MEDIUM	2
2026-07-28 00:07:28	LOW	3
2026-07-27 19:35:21	MEDIUM	2
2026-07-27 15:35:03	MEDIUM	2