caddy-trojan

maintainer tsaitang · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds Caddy from source with added modules, including trojan support, but all sources are from official or project-owned repositories; no untrusted executables or remote code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds Caddy from source with added modules, including trojan support, but all sources are from official or project-owned repositories; no untrusted executables or remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: ZhangHua <zhanghuadedn at gmail dot com>
    
      2# Contributor: Nicolas Stalder <n+archlinux@stalder.io>
    
      3
    
      4pkgname=caddy-trojan
    
      5pkgver=2.10.2
    
      6pkgrel=1
    
      7pkgdesc="Caddy web server with trojan support"
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://github.com/imgk/caddy-trojan"
    
      10license=('GPL-3.0-only')
    
      11depends=("glibc")
    
      12makedepends=('go')
    
      13provides=("caddy=${pkgver}")
    
      14conflicts=("caddy")
    
      15source=("caddy.hook"
    
      16        "caddy.sysusers"
    
      17        "caddy.tmpfiles"
    
      18        "https://raw.githubusercontent.com/caddyserver/dist/v${pkgver}/init/caddy.service"
    
      19        "https://raw.githubusercontent.com/caddyserver/dist/v${pkgver}/init/caddy-api.service"
    
      20        "https://raw.githubusercontent.com/caddyserver/dist/v${pkgver}/config/Caddyfile"
    
      21        "https://raw.githubusercontent.com/caddyserver/dist/v${pkgver}/welcome/index.html"
    
      22        "caddy-${pkgver}.tar.gz::https://github.com/caddyserver/caddy/archive/refs/tags/v${pkgver}.tar.gz")
    
      23sha256sums=('dfadb1f4a1f82024a11c110624680f98b3818305a16dd013363ca398020611ad'
    
      24            'a9294eeba17a8fd57cf11cef21e2eb3719a016646eeac0764a0d9f9f380a40ef'
    
      25            '99282b1a57857d23b97883dfd7dd147005956cc04405630d6e4d73bb7069f5ba'
    
      26            '6c271e030644bd36a0c8956885934f16c928f88202bc126f12cde519ef9693ff'
    
      27            'a794bbf7d890eb9e1231bbad251890f87870815a96e3820b28a71819ba9f9c14'
    
      28            '66177d46fa761acb07208065db9b0274cb1b12c02ac43b9bfc9857b698b1ccfe'
    
      29            '70a45d667679109cd6b25502554597f21536ee995ada0549251167bd171533b9'
    
      30            'f63f46b7ae68ced0a5c2e31df1b6dfc7656117d162a1bc7fed4bd4afd14ddc8f')
    
      31
    
      32prepare() {
    
      33    local -a MODULES=(
    
      34        #github.com/caddy-dns/route53
    
      35        github.com/caddy-dns/cloudflare
    
      36        github.com/caddy-dns/alidns
    
      37        github.com/caddy-dns/vultr
    
      38        #github.com/caddy-dns/dnspod
    
      39        github.com/caddy-dns/duckdns
    
      40        github.com/caddy-dns/gandi
    
      41        github.com/hairyhenderson/caddy-teapot-module
    
      42        github.com/caddyserver/transform-encoder
    
      43        github.com/mholt/caddy-webdav
    
      44        github.com/imgk/caddy-trojan
    
      45        github.com/imgk/caddy-pprof
    
      46        # Let caddy trust CDN's X-Forwarded-For header
    
      47        # Only cloudflare is found now.
    
      48        github.com/WeidiDeng/caddy-cloudflare-ip
    
      49    )
    
      50    cd "${srcdir}/caddy-${pkgver}/cmd/caddy"
    
      51    for m in "${MODULES[@]}"
    
      52    do
    
      53        echo "Adding module $m..."
    
      54        sed -i "/plug in Caddy modules here/a _ \"$m\"" main.go
    
      55        go get -modcacherw "$m"
    
      56    done
    
      57    go get -modcacherw .
    
      58}
    
      59build() {
    
      60    cd "${srcdir}/caddy-${pkgver}/cmd/caddy"
    
      61    export CGO_LDFLAGS="${LDFLAGS}"
    
      62    export CGO_CPPFLAGS="${CPPFLAGS}"
    
      63    export CGO_CFLAGS="${CFLAGS}"
    
      64    export CGO_CXXFLAGS="${CXXFLAGS}"
    
      65    export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
    
      66    go build .
    
      67
    
      68    for i in zsh bash fish; do
    
      69        ./caddy completion $i >caddy.${i}
    
      70    done
    
      71
    
      72}
    
      73
    
      74package() {
    
      75    install -Dm755 "${srcdir}/caddy-${pkgver}/cmd/caddy/caddy" "${pkgdir}/usr/bin/caddy"
    
      76    install -Dm644 "${srcdir}/caddy-${pkgver}/cmd/caddy/caddy.zsh" "${pkgdir}/usr/share/zsh/site-functions/_caddy"
    
      77    install -Dm644 "${srcdir}/caddy-${pkgver}/cmd/caddy/caddy.bash" "${pkgdir}/usr/share/bash-completion/completions/caddy"
    
      78    install -Dm644 "${srcdir}/caddy-${pkgver}/cmd/caddy/caddy.fish" -t "${pkgdir}/usr/share/fish/vendor_completions.d"
    
      79
    
      80    install -Dm644 "${srcdir}/Caddyfile" "${pkgdir}/usr/share/caddy/Caddyfile"
    
      81    install -Dm644 "${srcdir}/index.html" "${pkgdir}/usr/share/caddy/index.html"
    
      82
    
      83    install -Dm644 "${srcdir}/caddy.service" "${pkgdir}/usr/lib/systemd/system/caddy.service"
    
      84    install -Dm644 "${srcdir}/caddy-api.service" "${pkgdir}/usr/lib/systemd/system/caddy-api.service"
    
      85    install -Dm644 "${srcdir}/caddy.sysusers" "${pkgdir}/usr/lib/sysusers.d/caddy.conf"
    
      86    install -Dm644 "${srcdir}/caddy.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/caddy.conf"
    
      87
    
      88    install -Dm644 "${srcdir}/caddy.hook" "${pkgdir}/usr/share/libalpm/hooks/caddy-trojan.hook"
    
      89}
    
      90

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 05:14:03	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0