ampcode (MEDIUM) - AURWatch

Triggered rules

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:24 curl -fsS https://static.ampcode.com/cli/cli-version.txt | tr '-' '_'

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source_x86_64=("${pkgname}-${pkgver}-x64::https://static.ampcode.com/cli/${_amp_ver}/amp-linux-x64")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Yakov Till <yakov.till@gmail.com>
    
      2
    
      3pkgname=ampcode
    
      4pkgver=0.0.1793450357_gd44904
    
      5pkgrel=1
    
      6pkgdesc="Amp CLI — Sourcegraph's agentic coding tool"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://ampcode.com"
    
      9license=('LicenseRef-proprietary')
    
      10depends=('glibc')
    
      11optdepends=('ripgrep: faster file search (amp downloads its own if missing)')
    
      12options=('!strip' '!debug')
    
      13provides=('amp')
    
      14conflicts=('amp' 'ampcode-bin')
    
      15replaces=('sourcegraph-amp')
    
      16
    
      17_amp_ver=${pkgver//_/-}
    
      18source_x86_64=("${pkgname}-${pkgver}-x64::https://static.ampcode.com/cli/${_amp_ver}/amp-linux-x64")
    
      19source_aarch64=("${pkgname}-${pkgver}-arm64::https://static.ampcode.com/cli/${_amp_ver}/amp-linux-arm64")
    
      20sha256sums_x86_64=('e7d3f5023b627679a7ffc4319d8b5319e0b17bc5f121153c5a7f1103e6dbf25b')
    
      21sha256sums_aarch64=('05467eb062eb61803323987d34a5431e2cab836a30944781c21495ea7c62376c')
    
      22
    
      23latestver() {
    
      24    curl -fsS https://static.ampcode.com/cli/cli-version.txt | tr '-' '_'
    
      25}
    
      26
    
      27package() {
    
      28    case "${CARCH}" in
    
      29        x86_64)  install -Dm755 "${srcdir}/${pkgname}-${pkgver}-x64"   "${pkgdir}/usr/bin/amp" ;;
    
      30        aarch64) install -Dm755 "${srcdir}/${pkgname}-${pkgver}-arm64" "${pkgdir}/usr/bin/amp" ;;
    
      31    esac
    
      32}
    
      33

Changes since previous scan

--- PKGBUILD @ 2026-11-01 00:21
+++ PKGBUILD @ 2026-11-01 18:01
@@ -1,7 +1,7 @@
 # Maintainer: Yakov Till <yakov.till@gmail.com>
 
 pkgname=ampcode
-pkgver=0.0.1793404845_g2958dd
+pkgver=0.0.1793450357_gd44904
 pkgrel=1
 pkgdesc="Amp CLI — Sourcegraph's agentic coding tool"
 arch=('x86_64' 'aarch64')
@@ -17,8 +17,8 @@
 _amp_ver=${pkgver//_/-}
 source_x86_64=("${pkgname}-${pkgver}-x64::https://static.ampcode.com/cli/${_amp_ver}/amp-linux-x64")
 source_aarch64=("${pkgname}-${pkgver}-arm64::https://static.ampcode.com/cli/${_amp_ver}/amp-linux-arm64")
-sha256sums_x86_64=('6ab94448760d3b5b93089508f4f883508d98b193e3dc63ea99b559f02563057c')
-sha256sums_aarch64=('79ff9d67b923748d4dba2913e9a16cf55449d36e4b39dca89c1aecb771c70172')
+sha256sums_x86_64=('e7d3f5023b627679a7ffc4319d8b5319e0b17bc5f121153c5a7f1103e6dbf25b')
+sha256sums_aarch64=('05467eb062eb61803323987d34a5431e2cab836a30944781c21495ea7c62376c')
 
 latestver() {
     curl -fsS https://static.ampcode.com/cli/cli-version.txt | tr '-' '_'

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 18:01:05	Medium	2
2026-11-01 00:21:48	Low	3
2026-10-31 15:58:34	Medium	2
2026-10-31 01:57:41	Medium	2
2026-10-31 00:07:41	Low	3
2026-10-30 15:56:05	Medium	2
2026-10-30 00:29:30	Low	3
2026-10-29 13:52:19	Medium	2
2026-10-29 00:13:55	Low	3
2026-10-28 17:50:30	Medium	2
2026-10-28 01:49:03	Medium	2
2026-10-28 00:06:54	Low	3
2026-10-27 17:48:24	Medium	2
2026-10-27 01:46:28	Medium	3
2026-10-27 00:23:28	Medium	3
2026-10-26 13:45:05	Medium	3
2026-10-26 11:44:54	Medium	3
2026-10-26 03:43:44	Medium	3
2026-10-26 00:12:40	Medium	3
2026-10-25 17:43:03	Medium	3