busybox-alpinevariant-git

maintainer cuzrawr · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from the official busybox git repository and uses Alpine's configuration from a non-whitelisted but plausibly official source; both sources have SKIP'd checksums but no remote code execution or malicious behavior is present, and the build is otherwise standard for an AUR package.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the official busybox git repository and uses Alpine's configuration from a non-whitelisted but plausibly official source; both sources have SKIP'd checksums but no remote code execution or malicious behavior is present, and the build is otherwise standard for an AUR package.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("git+https://git.busybox.net/busybox"
PKGBUILD:15 "config::https://git.alpinelinux.org/aports/plain/main/busybox/busyboxconfig")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: cuzrawr
    
      2# original PKGBUILD copied from Chocobo1 ( pkg busybox-git ) ( thanks )
    
      3
    
      4pkgname=busybox-alpinevariant-git
    
      5pkgver=1.35.0.r133.g8d67007a4
    
      6pkgrel=1
    
      7pkgdesc="This variant of busybox primary focus on ash shell and optimized for everyday use as an light alternative to bash."
    
      8arch=('x86_64')
    
      9url="https://www.busybox.net/"
    
      10license=('GPL')
    
      11makedepends=('git' 'ncurses')
    
      12provides=('busybox-alpinevariant-git')
    
      13conflicts=("busybox" "busybox-custom" "busybox-custom-git" "mindi-busybox" "busybox-norootreboot" "busybox-git")
    
      14source=("git+https://git.busybox.net/busybox"
    
      15        "config::https://git.alpinelinux.org/aports/plain/main/busybox/busyboxconfig")
    
      16sha256sums=('SKIP'
    
      17            'SKIP')
    
      18install='busybox-alpinevariant-git.install'
    
      19
    
      20pkgver() {
    
      21  cd "busybox"
    
      22
    
      23  git describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/[_-]/./g'
    
      24}
    
      25
    
      26build() {
    
      27  cd "busybox"
    
      28
    
      29
    
      30  # .config: ( check readme.md )
    
      31  # cp "$srcdir/../config-example-latest" "$srcdir/busybox/.config"
    
      32  #
    
      33  # patch:
    
      34  # This patch just removes line numbers in history command
    
      35  # and making history output more readable and grepable.
    
      36
    
      37  cp "$srcdir/../show_history-patch.lineedit.c.patch" "$srcdir/busybox/lineedit.c.patch"
    
      38
    
      39  # For pure alpine busybox config uncoment this line:
    
      40  cp "$srcdir/../config" "$srcdir/busybox/.config"
    
      41  yes "" | make oldconfig
    
      42
    
      43  # Uncomment to make custom changes
    
      44  #
    
      45   #make menuconfig
    
      46
    
      47  # Apply fancy "show history output" patch
    
      48  patch -p0 < lineedit.c.patch
    
      49  export KCONFIG_NOTIMESTAMP=1  # reproducible build
    
      50  make
    
      51}
    
      52
    
      53check() {
    
      54  cd "busybox"
    
      55
    
      56  #make check
    
      57}
    
      58
    
      59package() {
    
      60  cd "busybox"
    
      61
    
      62  install -Dm755 "busybox" -t "$pkgdir/usr/bin"
    
      63
    
      64   # uncomment next lines for installing docs and manpages:
    
      65  #install -Dm644 "docs/busybox.1" -t "$pkgdir/usr/share/man/man1"
    
      66  #install -Dm644 "docs"/BusyBox.{html,txt} -t "$pkgdir/usr/share/doc/busybox"
    
      67}
    
      68

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2