bluegit-runner

LOW

maintainer Timfa 0 votes scanned 2026-10-24 13:42:06.374786

View on AUR

Why flagged

Package builds from source tarball hosted on what appears to be the project's own Gitea instance (git.timfalken.com) with a pinned commit and a matching sha256 checksum; the build and install hooks are straightforward Go compilation and standard systemd integration with no obfuscation or remote code execution. The only concern is that it's a personal/self-hosted forge with few votes, but the source is verified by checksum and the code path is transparent.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): Package builds from source tarball hosted on what appears to be the project's own Gitea instance (git.timfalken.com) with a pinned commit and a matching sha256 checksum; the build and install hooks are straightforward Go compilation and standard systemd integration with no obfuscation or remote code execution. The only concern is that it's a personal/self-hosted forge with few votes, but the source is verified by checksum and the code path is transparent.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("bluegit-${_commit}.tar.gz::https://git.timfalken.com/timfa/bluegit/-/archive/${_commit}/bluegit-${_commit}.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Tim Falken <tim@timfalken.com>
    
      2pkgname=bluegit-runner
    
      3pkgver=20261024131232
    
      4pkgrel=1
    
      5pkgdesc='Separate CI runner for BlueGit (runs jobs in Docker on your own machine)'
    
      6arch=('x86_64' 'aarch64')
    
      7url='https://git.timfalken.com/timfa/bluegit'
    
      8license=('MIT')
    
      9depends=('git' 'docker')
    
      10makedepends=('go')
    
      11options=('!debug')
    
      12install=bluegit-runner.install
    
      13_commit=f7bc7acd7271fd8931694b67f4ae8ff0dd052c9a
    
      14source=("bluegit-${_commit}.tar.gz::https://git.timfalken.com/timfa/bluegit/-/archive/${_commit}/bluegit-${_commit}.tar.gz")
    
      15sha256sums=('b16c32813cb770a4e0cbcff7b26eab9a1a7fbe8f39e083150afc287c1fec8884')
    
      16
    
      17build() {
    
      18  cd "$srcdir/bluegit-${_commit}"
    
      19  export CGO_ENABLED=0
    
      20  export GOFLAGS='-trimpath'
    
      21  export GOCACHE="${BUILDDIR:-$srcdir}/gocache"
    
      22  export GOPATH="${BUILDDIR:-$srcdir}/gopath"
    
      23  go build -ldflags="-s -w -X main.version=${pkgver}" -o bluegit-runner ./cmd/bluegit-runner
    
      24}
    
      25
    
      26package() {
    
      27  cd "$srcdir/bluegit-${_commit}"
    
      28  install -Dm755 bluegit-runner "$pkgdir/usr/bin/bluegit-runner"
    
      29  install -Dm644 packaging/runner/bluegit-runner.service "$pkgdir/usr/lib/systemd/system/bluegit-runner.service"
    
      30  install -Dm644 packaging/runner/sysusers.conf "$pkgdir/usr/lib/sysusers.d/bluegit-runner.conf"
    
      31  install -Dm644 packaging/runner/tmpfiles.conf "$pkgdir/usr/lib/tmpfiles.d/bluegit-runner.conf"
    
      32  install -Dm644 packaging/runner/config.yml.example "$pkgdir/usr/share/bluegit-runner/config.yml.example"
    
      33  install -Dm644 docs/runner.md "$pkgdir/usr/share/doc/bluegit-runner/README.md"
    
      34  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-24 13:42:06	Low	3
2026-10-24 13:40:12	Medium	2