ampcode (MEDIUM) - AURWatch

Triggered rules

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:24 curl -fsS https://static.ampcode.com/cli/cli-version.txt | tr '-' '_'

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source_x86_64=("${pkgname}-${pkgver}-x64::https://static.ampcode.com/cli/${_amp_ver}/amp-linux-x64")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Yakov Till <yakov.till@gmail.com>
    
      2
    
      3pkgname=ampcode
    
      4pkgver=0.0.1789607146_g57354f
    
      5pkgrel=1
    
      6pkgdesc="Amp CLI — Sourcegraph's agentic coding tool"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://ampcode.com"
    
      9license=('LicenseRef-proprietary')
    
      10depends=('glibc')
    
      11optdepends=('ripgrep: faster file search (amp downloads its own if missing)')
    
      12options=('!strip' '!debug')
    
      13provides=('amp')
    
      14conflicts=('amp' 'ampcode-bin')
    
      15replaces=('sourcegraph-amp')
    
      16
    
      17_amp_ver=${pkgver//_/-}
    
      18source_x86_64=("${pkgname}-${pkgver}-x64::https://static.ampcode.com/cli/${_amp_ver}/amp-linux-x64")
    
      19source_aarch64=("${pkgname}-${pkgver}-arm64::https://static.ampcode.com/cli/${_amp_ver}/amp-linux-arm64")
    
      20sha256sums_x86_64=('328872272409c6af9e3e674e7df2d89801320927d9691f7491e7b9146e2af43a')
    
      21sha256sums_aarch64=('acb68d85f92f36a8ddd1b57e99228fa58c2f8141a74d5f35a65ef4765c0a9448')
    
      22
    
      23latestver() {
    
      24    curl -fsS https://static.ampcode.com/cli/cli-version.txt | tr '-' '_'
    
      25}
    
      26
    
      27package() {
    
      28    case "${CARCH}" in
    
      29        x86_64)  install -Dm755 "${srcdir}/${pkgname}-${pkgver}-x64"   "${pkgdir}/usr/bin/amp" ;;
    
      30        aarch64) install -Dm755 "${srcdir}/${pkgname}-${pkgver}-arm64" "${pkgdir}/usr/bin/amp" ;;
    
      31    esac
    
      32}
    
      33

Changes since previous scan

--- PKGBUILD @ 2026-09-17 03:24
+++ PKGBUILD @ 2026-09-17 15:25
@@ -1,7 +1,7 @@
 # Maintainer: Yakov Till <yakov.till@gmail.com>
 
 pkgname=ampcode
-pkgver=0.0.1789549843_gf041d8
+pkgver=0.0.1789607146_g57354f
 pkgrel=1
 pkgdesc="Amp CLI — Sourcegraph's agentic coding tool"
 arch=('x86_64' 'aarch64')
@@ -17,8 +17,8 @@
 _amp_ver=${pkgver//_/-}
 source_x86_64=("${pkgname}-${pkgver}-x64::https://static.ampcode.com/cli/${_amp_ver}/amp-linux-x64")
 source_aarch64=("${pkgname}-${pkgver}-arm64::https://static.ampcode.com/cli/${_amp_ver}/amp-linux-arm64")
-sha256sums_x86_64=('80b20ad1768727f4904ca9e59b1865a87bb1cfe955159366175cac8c241bf75c')
-sha256sums_aarch64=('3f9cff5f9d63f0143fa1b31970d80c618e3bad1c2914f473d2240f7cda9a1243')
+sha256sums_x86_64=('328872272409c6af9e3e674e7df2d89801320927d9691f7491e7b9146e2af43a')
+sha256sums_aarch64=('acb68d85f92f36a8ddd1b57e99228fa58c2f8141a74d5f35a65ef4765c0a9448')
 
 latestver() {
     curl -fsS https://static.ampcode.com/cli/cli-version.txt | tr '-' '_'

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 15:25:49	Medium	2
2026-09-17 03:24:22	Medium	2
2026-09-17 00:27:14	Low	3
2026-09-16 11:22:36	Medium	2
2026-09-16 00:03:17	Low	3
2026-09-15 23:20:44	Medium	2
2026-09-15 09:19:41	Medium	2
2026-09-15 00:25:31	Low	3
2026-09-14 23:18:17	Medium	2
2026-09-14 21:18:01	Medium	2
2026-09-14 11:16:56	Medium	2
2026-09-14 00:27:57	Low	3
2026-09-13 23:15:25	Medium	2
2026-09-13 19:15:06	Medium	2
2026-09-13 17:14:56	Medium	2
2026-09-13 00:19:54	Low	3
2026-09-12 15:12:25	Medium	2
2026-09-12 00:25:17	Low	3
2026-09-11 21:24:02	Medium	2
2026-09-11 13:22:32	Medium	2