atomgit-cli

LOW

maintainer moyigeek 0 votes scanned 2026-08-21 11:16:46.729832

View on AUR

Why flagged

Package builds from the project's own source repository on atomgit.com (a legitimate Chinese open-source forge) via a tagged git checkout; the SKIP checksum is normal for git sources, and the build process is straightforward Go compilation with no remote code execution or exfiltration concerns.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Package builds from the project's own source repository on atomgit.com (a legitimate Chinese open-source forge) via a tagged git checkout; the SKIP checksum is normal for git sources, and the build process is straightforward Go compilation with no remote code execution or exfiltration concerns.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("git+https://atomgit.com/hust-open-atom-club/atomgit-cli.git#tag=v${pkgver}")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Your Name <you@example.com>
    
      2
    
      3pkgname=atomgit-cli
    
      4pkgver=0.7.2
    
      5pkgrel=1
    
      6pkgdesc="AtomGit CLI (ag) - 基于 AtomGit API 的命令行工具，参考 GitHub CLI (gh) 开发"
    
      7arch=('x86_64' 'aarch64' 'loong64')
    
      8url="https://atomgit.com/hust-open-atom-club/atomgit-cli"
    
      9license=('custom:MulanPSL-2.0')
    
      10depends=('glibc')
    
      11makedepends=('go')
    
      12provides=('ag')
    
      13conflicts=('ag' 'ag-bin' 'atomgit-cli-bin')
    
      14source=("git+https://atomgit.com/hust-open-atom-club/atomgit-cli.git#tag=v${pkgver}")
    
      15sha256sums=('SKIP')
    
      16
    
      17_commit=fd2d0c29349e2251732711e877a1a58fabbeec54
    
      18_builddate="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
    
      19
    
      20build() {
    
      21    cd "${srcdir}/atomgit-cli"
    
      22    export CGO_ENABLED=0
    
      23    go build -trimpath -o ag \
    
      24        -ldflags "-s -w \
    
      25        -X atomgit.com/hust-open-atom-club/atomgit-cli/internal/version.Version=v${pkgver} \
    
      26        -X atomgit.com/hust-open-atom-club/atomgit-cli/internal/version.Commit=${_commit} \
    
      27        -X atomgit.com/hust-open-atom-club/atomgit-cli/internal/version.BuildDate=${_builddate}" \
    
      28        ./cmd/ag
    
      29}
    
      30
    
      31package() {
    
      32    cd "${srcdir}/atomgit-cli"
    
      33    install -Dm755 "ag" "${pkgdir}/usr/bin/ag"
    
      34    install -Dm644 "LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-21 11:16:46	Low	3
2026-08-21 11:15:01	Medium	2