check_email_delivery

maintainer crt · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a source tarball from the maintainer's personal domain, which is not on a standard forge, but the content is a plain Perl script collection built and installed directly; the worst case of a swapped source is limited to code execution during package use, but it is not an obfuscated payload or remote code execution at install time, and the project is small and plausibly maintained independently.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from the maintainer's personal domain, which is not on a standard forge, but the content is a plain Perl script collection built and installed directly; the worst case of a swapped source is limited to code execution during package use, but it is not an obfuscated payload or remote code execution at install time, and the project is small and plausibly maintained independently.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("http://buhacoff.net/software/check_email_delivery/archive/${pkgname}-${pkgver}.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AK <crt@archlinux.email>
    
      2
    
      3pkgname=check_email_delivery
    
      4pkgver=0.7.1b
    
      5pkgrel=1
    
      6pkgdesc="The check_email_delivery plugin uses the included Nagios plugins to check on a complete email loop."
    
      7arch=('any')
    
      8url="http://buhacoff.net/software/check_email_delivery/"
    
      9license=('GPL3')
    
      10depends=('perl-mail-imapclient')
    
      11source=("http://buhacoff.net/software/check_email_delivery/archive/${pkgname}-${pkgver}.tar.gz")
    
      12sha512sums=('d1fdc3082e443b4f54f230eb6231581edf6563d0012c333ef50a35b26579f93568cee8b70cfb2dfc332d0eceb5add31a8c7f93681d2baeeb08d229c0de32ac39')
    
      13
    
      14package() {
    
      15    cd ${pkgname}-${pkgver}
    
      16    # Install License
    
      17    install -Dm644 "LICENSE.txt" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      18   
    
      19    # Put check_email_delivery checks in /usr/lib/monitoring-plugins
    
      20    install -Dm755 "check_email_delivery"       "$pkgdir/usr/lib/monitoring-plugins/check_email_delivery"
    
      21    install -Dm755 "check_email_delivery_epn"   "$pkgdir/usr/lib/monitoring-plugins/check_email_delivery_epn"
    
      22    install -Dm755 "check_imap_receive"         "$pkgdir/usr/lib/monitoring-plugins/check_imap_receive"
    
      23    install -Dm755 "check_imap_receive_epn"     "$pkgdir/usr/lib/monitoring-plugins/check_imap_receive_epn"
    
      24    install -Dm755 "check_smtp_send"            "$pkgdir/usr/lib/monitoring-plugins/check_smtp_send"
    
      25    install -Dm755 "check_smtp_send_epn"        "$pkgdir/usr/lib/monitoring-plugins/check_smtp_send_epn"
    
      26}
    
      27
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2