anyshift-annie-bin
LOW
maintainer anyshift
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads prebuilt binaries from the project's own domain (anyshift.io), which is plausibly official; the binaries are checksum-verified and installed directly, posing low risk despite the non-whitelisted host.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from the project's own domain (anyshift.io), which is plausibly official; the binaries are checksum-verified and installed directly, posing low risk despite the non-whitelisted host.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:15
source_aarch64=("${pkgname}_${pkgver}_aarch64.tar.gz::https://annie-cli.anyshift.io/releases/${pkgver}/annie-${pkgver}-linux-arm64.tar.gz")
PKGBUILD
1 offending line(s) highlighted
1
# This file was generated by GoReleaser. DO NOT EDIT.
2
# Maintainer: Anyshift Engineering <engineering@anyshift.io>
3
4
pkgname='anyshift-annie-bin'
5
pkgver=0.9.6
6
pkgrel=1
7
pkgdesc='AI-powered infrastructure observability CLI'
8
url='https://anyshift.io'
9
arch=('aarch64' 'x86_64')
10
license=('Proprietary')
11
provides=('annie')
12
conflicts=('annie')
13
depends=('glibc')
14
15
source_aarch64=("${pkgname}_${pkgver}_aarch64.tar.gz::https://annie-cli.anyshift.io/releases/${pkgver}/annie-${pkgver}-linux-arm64.tar.gz")
16
sha256sums_aarch64=('fbda8e496f294abf86e993ca1fcb3e999dfcf8be5e054d8d8fa0578af22b1eaa')
17
18
source_x86_64=("${pkgname}_${pkgver}_x86_64.tar.gz::https://annie-cli.anyshift.io/releases/${pkgver}/annie-${pkgver}-linux-amd64.tar.gz")
19
sha256sums_x86_64=('d8e83b291ea494443eea27856b7ee0cacab1a8db76bf081d448b3c5fb186a274')
20
21
package() {
22
install -Dm755 "./annie" "${pkgdir}/usr/bin/annie"
23
}
24
Changes since previous scan
--- PKGBUILD @ 2026-09-16 21:23+++ PKGBUILD @ 2026-09-17 00:27@@ -2,7 +2,7 @@ # Maintainer: Anyshift Engineering <engineering@anyshift.io> pkgname='anyshift-annie-bin'-pkgver=0.9.5+pkgver=0.9.6 pkgrel=1 pkgdesc='AI-powered infrastructure observability CLI' url='https://anyshift.io'@@ -13,10 +13,10 @@ depends=('glibc') source_aarch64=("${pkgname}_${pkgver}_aarch64.tar.gz::https://annie-cli.anyshift.io/releases/${pkgver}/annie-${pkgver}-linux-arm64.tar.gz")-sha256sums_aarch64=('a6f85694095361ca8adf834c009a84b52b891a6e4dc9d221cd6282e4a6c9a25d')+sha256sums_aarch64=('fbda8e496f294abf86e993ca1fcb3e999dfcf8be5e054d8d8fa0578af22b1eaa') source_x86_64=("${pkgname}_${pkgver}_x86_64.tar.gz::https://annie-cli.anyshift.io/releases/${pkgver}/annie-${pkgver}-linux-amd64.tar.gz")-sha256sums_x86_64=('d02129f2dfc3b76f222ca74e917efee513cd195524e50130999ad8aa60fc6d9f')+sha256sums_x86_64=('d8e83b291ea494443eea27856b7ee0cacab1a8db76bf081d448b3c5fb186a274') package() { install -Dm755 "./annie" "${pkgdir}/usr/bin/annie"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 23:24:19 | Medium | 1 |
| 2026-09-16 21:23:45 | Medium | 2 |
| 2026-09-16 19:23:36 | Medium | 1 |
| 2026-09-16 13:22:46 | Medium | 1 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 17:22:59 | Medium | 1 |
| 2026-09-11 15:22:58 | Medium | 1 |
| 2026-09-11 11:22:29 | Medium | 1 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 11:19:32 | Medium | 1 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 15:17:32 | Medium | 1 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |