ayllu
LOW
maintainer kevinschoon
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The source is a tarball from the project's own domain, used to build the project's own code, which is standard AUR packaging; the non-whitelisted host is the project's official site, so the risk is low despite the static analyzer flag.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the project's own domain, used to build the project's own code, which is standard AUR packaging; the non-whitelisted host is the project's official site, so the risk is low despite the static analyzer flag.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:17
"$pkgname-$pkgver::https://ayllu-forge.org/ayllu/ayllu/refs/archive/$pkgver.tar.gz"
PKGBUILD
1 offending line(s) highlighted
1
pkgname=ayllu
2
pkgver=0.5.1
3
pkgrel=1
4
pkgdesc="Ayllu Forge"
5
arch=("x86_64")
6
license=("AGPL3")
7
url="https://ayllu-forge.org/projects/ayllu"
8
depends=(
9
"git"
10
)
11
makedepends=(
12
"rust"
13
)
14
provides=("ayllu")
15
optdepends=()
16
source=(
17
"$pkgname-$pkgver::https://ayllu-forge.org/ayllu/ayllu/refs/archive/$pkgver.tar.gz"
18
)
19
20
sha256sums=("f761da5740aa7da683276bb3ba1363995d38ae34abb7c3530f1f71476d80f360")
21
# See: https://gitlab.archlinux.org/archlinux/packaging/packages/pacman/-/issues/20
22
options=(!lto)
23
24
prepare() {
25
cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
26
}
27
28
check() {
29
cargo test --frozen --all-features
30
}
31
32
build() {
33
export CARGO_TARGET_DIR=target
34
cargo build --frozen --release --all-features
35
}
36
37
package() {
38
SRC_ROOT="${srcdir}/${pkgname}-${pkgver}"
39
install -Dm755 \
40
"${srcdir}/target/release/ayllu" "${pkgdir}/usr/bin/ayllu"
41
install -Dm755 \
42
"${srcdir}/target/release/quipu" "${pkgdir}/usr/bin/quipu"
43
install -Dm755 \
44
"${srcdir}/target/release/ayllu-shell" "${pkgdir}/usr/bin/ayllu-shell"
45
install -Dm755 \
46
"${srcdir}/target/release/ayllu-keys" "${pkgdir}/usr/bin/ayllu-keys"
47
install -Dm644 \
48
"${SRC_ROOT}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}"
49
install -Dm644 \
50
"${SRC_ROOT}/config.example.toml" "${pkgdir}/etc/ayllu/config.example.toml"
51
install -Dm644 \
52
"${SRC_ROOT}/contrib/systemd/ayllu-sysusers.conf" \
53
"${pkgdir}/usr/lib/sysusers.d/ayllu.conf"
54
install -Dm644 \
55
"${SRC_ROOT}/contrib/systemd/system/ayllu.service" \
56
"${pkgdir}/usr/lib/systemd/system/ayllu.service"
57
install -Dm644 \
58
"${SRC_ROOT}/contrib/systemd/user/ayllu.service" \
59
"${pkgdir}/usr/lib/systemd/user/ayllu.service"
60
}
61
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |