bnetctl-git

LOW

maintainer bnema 0 votes scanned 2026-11-02 18:05:06.348541

View on AUR

Why flagged

Clones and builds the project's own source from the maintainer's self-hosted Gitea instance (git.bnema.dev), which is plausibly the project's own infrastructure; the non-whitelisted host and SKIP checksum are typical for a git+https VCS source in AUR packaging and pose no meaningful supply-chain risk beyond trusting the maintainer's server.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Clones and builds the project's own source from the maintainer's self-hosted Gitea instance (git.bnema.dev), which is plausibly the project's own infrastructure; the non-whitelisted host and SKIP checksum are typical for a git+https VCS source in AUR packaging and pose no meaningful supply-chain risk beyond trusting the maintainer's server.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=('git+https://git.bnema.dev/bnetctl.git')

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: bnema <b at bnema dot dev>
    
      2pkgname=bnetctl-git
    
      3pkgver=1.1.0.r0.g16b1719
    
      4pkgrel=1
    
      5pkgdesc='CLI to install, manage, and run Battle.net on Linux via Wine (git version)'
    
      6arch=('x86_64' 'aarch64')
    
      7url='https://git.bnema.dev/bnetctl'
    
      8license=('MIT')
    
      9makedepends=('go>=2:1.26.0' 'git')
    
      10optdepends=('wine-staging: Wine runtime (>= 11.19 for Wayland)'
    
      11	'wine: alternative Wine runtime'
    
      12	'wine-cachyos-opt: fallback Wine runtime'
    
      13	'dxvk-mingw-git: Direct3D 8/9/10/11 translation to Vulkan'
    
      14	'vkd3d-proton-mingw-git: Direct3D 12 translation to Vulkan'
    
      15	'icoutils: Battle.net icon for the .desktop entry')
    
      16provides=('bnetctl')
    
      17conflicts=('bnetctl' 'bnetctl-bin')
    
      18source=('git+https://git.bnema.dev/bnetctl.git')
    
      19sha256sums=('SKIP')
    
      20
    
      21pkgver() {
    
      22	cd bnetctl
    
      23	git describe --long --tags --abbrev=7 --exclude='*-*' | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      24}
    
      25
    
      26prepare() {
    
      27	cd bnetctl
    
      28	export GOPATH="$srcdir/gopath" GOTOOLCHAIN=local
    
      29	export GOFLAGS='-mod=readonly -modcacherw'
    
      30	go mod download
    
      31}
    
      32
    
      33build() {
    
      34	cd bnetctl
    
      35	export GOPATH="$srcdir/gopath" CGO_ENABLED=0 GOTOOLCHAIN=local
    
      36	export GOFLAGS='-buildmode=pie -trimpath -mod=readonly -modcacherw'
    
      37	go build -ldflags "-X github.com/bnema/bnetctl/cmd.version=$pkgver -X github.com/bnema/bnetctl/cmd.commit=$(git rev-parse --short HEAD)" -o bnetctl .
    
      38}
    
      39
    
      40check() {
    
      41	cd bnetctl
    
      42	./bnetctl --version
    
      43}
    
      44
    
      45package() {
    
      46	cd bnetctl
    
      47	install -Dm755 bnetctl "$pkgdir/usr/bin/bnetctl"
    
      48	install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-02 18:05:06	Low	3
2026-11-02 18:02:51	Medium	2