arcctl

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a prebuilt binary from the official vendor's support site (areca.us), which is plausibly the project's own infrastructure; the host is not whitelisted but not inherently swappable like personal file hosts, and the binary is installed directly without obfuscation or remote code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a prebuilt binary from the official vendor's support site (areca.us), which is plausibly the project's own infrastructure; the host is not whitelisted but not inherently swappable like personal file hosts, and the binary is installed directly without obfuscation or remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=(https://www.areca.us/support/s_linux/driver/cli/linuxcli_V${pkgver}_${_buildver}.zip)

PKGBUILD

1 offending line(s) highlighted

      1# $Id: PKGBUILD 111935 2014-05-27 07:39:44Z mtorromeo $
    
      2# Maintainer: Massimiliano Torromeo <massimiliano.torromeo@gmail.com>
    
      3
    
      4pkgname=arcctl
    
      5pkgver=1.15.8
    
      6pkgrel=1
    
      7_buildver=180529
    
      8pkgrel=1
    
      9pkgdesc="CLI tools to manage Areca's ARC11xx/ARC12xx/ARC16xx/ARC18xx RAID controllers"
    
      10arch=('i686' 'x86_64')
    
      11url="https://www.areca.us/support/s_linux/linux.htm"
    
      12license=('custom')
    
      13depends=('gcc-libs')
    
      14source=(https://www.areca.us/support/s_linux/driver/cli/linuxcli_V${pkgver}_${_buildver}.zip)
    
      15sha256sums=('c73a1e80cc0e23d0940259c1a3efd2aad7d906c93b5c7556277623bf394323d2')
    
      16
    
      17package() {
    
      18  if [ $CARCH == x86_64 ]; then
    
      19    install -Dm755 linuxcli_V${pkgver}_${_buildver}/x86_64/cli64 "$pkgdir"/usr/bin/arcctl
    
      20  else
    
      21    install -Dm755 linuxcli_V${pkgver}_${_buildver}/i386/cli32 "$pkgdir"/usr/bin/arcctl
    
      22  fi
    
      23}
    
      24

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2