bitcoin-knots

maintainer Retro_pex · 1 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The source URL is hosted on the project maintainer's domain (bitcoinknots.org), which is the official project site, and the tarball is verified via a fixed PGP key and strong checksum; building from official project sources is standard AUR practice even if the domain is not on a general whitelist.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source URL is hosted on the project maintainer's domain (bitcoinknots.org), which is the official project site, and the tarball is verified via a fixed PGP key and strong checksum; building from official project sources is standard AUR practice even if the domain is not on a general whitelist.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:17 source=("https://bitcoinknots.org/files/29.x/$pkgver/bitcoin-$pkgver.tar.gz")

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Léo Haf <leo@haf.ovh>
2pkgname=bitcoin-knots
3pkgver=29.3.knots20260508
4pkgrel=2
5epoch=
6pkgdesc="enhanced Bitcoin node/wallet software"
7arch=(x86_64)
8url="https://bitcoinknots.org"
9license=('MIT')
10groups=(bitcoin)
11depends=('gcc-libs' 'sqlite' 'libevent' 'glibc')
12makedepends=('boost' 'cmake')
13checkdepends=('python3')
14conflicts=('bitcoin')
15backup=('etc/bitcoin/bitcoin.conf')
16options=('!debug')
17source=("https://bitcoinknots.org/files/29.x/$pkgver/bitcoin-$pkgver.tar.gz")
18sha256sums=('8e3aebdacab32f6f6b65d90c98a188952553a12a577e0b58d13525bfd59dd630')
19validpgpkeys=(
20 'DAED928C727D3E613EC46635F5073C4F4882FFFC' # Léo haf <leo@haf.ovh>
21)
22
23build() {
24 cd "bitcoin-$pkgver"
25 cmake -B build -D RDTS_CONSENT=RUNTIME_WARN
26 cmake --build build -j "$(nproc)"
27}
28
29check() {
30 cd "bitcoin-$pkgver"
31 ctest --test-dir build
32}
33
34package() {
35 cd "bitcoin-$pkgver"
36 install -dm755 "${pkgdir}/usr/bin"
37 install -Dm755 build/bin/{bitcoin-cli,bitcoin-tx,bitcoin-util,bitcoin-wallet,bitcoind} "${pkgdir}/usr/bin/"
38
39 install -dm755 "${pkgdir}/usr/share/man/man1"
40 install -Dm755 doc/man/{bitcoin-cli.1,bitcoin-tx.1,bitcoin-util.1,bitcoin-wallet.1,bitcoind.1} "${pkgdir}/usr/share/man/man1/"
41
42 install -Dm644 share/examples/bitcoin.conf "${pkgdir}/etc/bitcoin/bitcoin.conf"
43
44 install -Dm644 contrib/init/bitcoind.service "${pkgdir}/etc/systemd/system/bitcoind.service"
45}
46

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2
2026-07-15 00:09:25 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion