arduino-cli-git

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from the official project's git repository using Go, which is standard for AUR packages; the 'go install' command fetches the latest version of the official upstream module, not an external untrusted dependency, so the risk is low despite the static analyzer flag.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package builds from the official project's git repository using Go, which is standard for AUR packages; the 'go install' command fetches the latest version of the official upstream module, not an external untrusted dependency, so the risk is low despite the static analyzer flag.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:30 GOPATH="$gopath" GO111MODULE=on go install github.com/arduino/arduino-cli@latest

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Peter Varo <hello@petervaro.com>
    
      2
    
      3pkgname=arduino-cli-git
    
      4pkgver=r690.2f07f94
    
      5pkgver() {
    
      6    cd "arduino-cli"
    
      7    printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      8}
    
      9pkgrel=1
    
      10pkgdesc="Arduino command line interface"
    
      11arch=(
    
      12    'x86_64'
    
      13    'i686'
    
      14)
    
      15url="https://github.com/arduino/arduino-cli"
    
      16license=('GPL3')
    
      17groups=('arduino')
    
      18makedepends=(
    
      19    'go'
    
      20    'git'
    
      21)
    
      22source=("git://github.com/arduino/arduino-cli.git")
    
      23md5sums=('SKIP')
    
      24package() {
    
      25    gopath="$GOPATH"
    
      26    if [ -z "$gopath" ]
    
      27    then
    
      28        gopath="$HOME/go"
    
      29    fi;
    
      30    GOPATH="$gopath" GO111MODULE=on go install github.com/arduino/arduino-cli@latest
    
      31    install -Dm755 "$gopath/bin/arduino-cli" "$pkgdir/usr/bin/arduino-cli"
    
      32}
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2