ayllu
maintainer kevinschoon
· 1 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The source is a tarball from the project's own domain, used to build the project's own code, which is standard AUR packaging; the non-whitelisted host is the project's official site, so the risk is low despite the static analyzer flag.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the project's own domain, used to build the project's own code, which is standard AUR packaging; the non-whitelisted host is the project's official site, so the risk is low despite the static analyzer flag.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:17
"$pkgname-$pkgver::https://ayllu-forge.org/ayllu/ayllu/refs/archive/$pkgver.tar.gz"
PKGBUILD
1 offending line(s) highlighted
1
pkgname=ayllu
2
pkgver=0.5.1
3
pkgrel=1
4
pkgdesc="Ayllu Forge"
5
arch=("x86_64")
6
license=("AGPL3")
7
url="https://ayllu-forge.org/projects/ayllu"
8
depends=(
9
"git"
10
)
11
makedepends=(
12
"rust"
13
)
14
provides=("ayllu")
15
optdepends=()
16
source=(
17
"$pkgname-$pkgver::https://ayllu-forge.org/ayllu/ayllu/refs/archive/$pkgver.tar.gz"
18
)
19
20
sha256sums=("f761da5740aa7da683276bb3ba1363995d38ae34abb7c3530f1f71476d80f360")
21
# See: https://gitlab.archlinux.org/archlinux/packaging/packages/pacman/-/issues/20
22
options=(!lto)
23
24
prepare() {
25
cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
26
}
27
28
check() {
29
cargo test --frozen --all-features
30
}
31
32
build() {
33
export CARGO_TARGET_DIR=target
34
cargo build --frozen --release --all-features
35
}
36
37
package() {
38
SRC_ROOT="${srcdir}/${pkgname}-${pkgver}"
39
install -Dm755 \
40
"${srcdir}/target/release/ayllu" "${pkgdir}/usr/bin/ayllu"
41
install -Dm755 \
42
"${srcdir}/target/release/quipu" "${pkgdir}/usr/bin/quipu"
43
install -Dm755 \
44
"${srcdir}/target/release/ayllu-shell" "${pkgdir}/usr/bin/ayllu-shell"
45
install -Dm755 \
46
"${srcdir}/target/release/ayllu-keys" "${pkgdir}/usr/bin/ayllu-keys"
47
install -Dm644 \
48
"${SRC_ROOT}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}"
49
install -Dm644 \
50
"${SRC_ROOT}/config.example.toml" "${pkgdir}/etc/ayllu/config.example.toml"
51
install -Dm644 \
52
"${SRC_ROOT}/contrib/systemd/ayllu-sysusers.conf" \
53
"${pkgdir}/usr/lib/sysusers.d/ayllu.conf"
54
install -Dm644 \
55
"${SRC_ROOT}/contrib/systemd/system/ayllu.service" \
56
"${pkgdir}/usr/lib/systemd/system/ayllu.service"
57
install -Dm644 \
58
"${SRC_ROOT}/contrib/systemd/user/ayllu.service" \
59
"${pkgdir}/usr/lib/systemd/user/ayllu.service"
60
}
61
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |