ayllu
LOW
maintainer kevinschoon
1 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The source is a tarball from the project's own domain, used to build the project's own code, which is standard AUR packaging; the non-whitelisted host is the project's official site, so the risk is low despite the static analyzer flag.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the project's own domain, used to build the project's own code, which is standard AUR packaging; the non-whitelisted host is the project's official site, so the risk is low despite the static analyzer flag.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:17
"$pkgname-$pkgver::https://ayllu-forge.org/ayllu/ayllu/refs/archive/$pkgver.tar.gz"
PKGBUILD
1 offending line(s) highlighted
1
pkgname=ayllu
2
pkgver=0.5.1
3
pkgrel=1
4
pkgdesc="Ayllu Forge"
5
arch=("x86_64")
6
license=("AGPL3")
7
url="https://ayllu-forge.org/projects/ayllu"
8
depends=(
9
"git"
10
)
11
makedepends=(
12
"rust"
13
)
14
provides=("ayllu")
15
optdepends=()
16
source=(
17
"$pkgname-$pkgver::https://ayllu-forge.org/ayllu/ayllu/refs/archive/$pkgver.tar.gz"
18
)
19
20
sha256sums=("f761da5740aa7da683276bb3ba1363995d38ae34abb7c3530f1f71476d80f360")
21
# See: https://gitlab.archlinux.org/archlinux/packaging/packages/pacman/-/issues/20
22
options=(!lto)
23
24
prepare() {
25
cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
26
}
27
28
check() {
29
cargo test --frozen --all-features
30
}
31
32
build() {
33
export CARGO_TARGET_DIR=target
34
cargo build --frozen --release --all-features
35
}
36
37
package() {
38
SRC_ROOT="${srcdir}/${pkgname}-${pkgver}"
39
install -Dm755 \
40
"${srcdir}/target/release/ayllu" "${pkgdir}/usr/bin/ayllu"
41
install -Dm755 \
42
"${srcdir}/target/release/quipu" "${pkgdir}/usr/bin/quipu"
43
install -Dm755 \
44
"${srcdir}/target/release/ayllu-shell" "${pkgdir}/usr/bin/ayllu-shell"
45
install -Dm755 \
46
"${srcdir}/target/release/ayllu-keys" "${pkgdir}/usr/bin/ayllu-keys"
47
install -Dm644 \
48
"${SRC_ROOT}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}"
49
install -Dm644 \
50
"${SRC_ROOT}/config.example.toml" "${pkgdir}/etc/ayllu/config.example.toml"
51
install -Dm644 \
52
"${SRC_ROOT}/contrib/systemd/ayllu-sysusers.conf" \
53
"${pkgdir}/usr/lib/sysusers.d/ayllu.conf"
54
install -Dm644 \
55
"${SRC_ROOT}/contrib/systemd/system/ayllu.service" \
56
"${pkgdir}/usr/lib/systemd/system/ayllu.service"
57
install -Dm644 \
58
"${SRC_ROOT}/contrib/systemd/user/ayllu.service" \
59
"${pkgdir}/usr/lib/systemd/user/ayllu.service"
60
}
61
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |