cloudfoundry-cli

maintainer AbrarSyed · 16 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt binary and a completion script from Cloud Foundry's official infrastructure (cli.run.pivotal.io and raw.githubusercontent.com), which are legitimate sources for the project; the binary is installed directly and no malicious activity is present, making this a standard AUR package with a minor trust concern due to the non-whitelisted host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary and a completion script from Cloud Foundry's official infrastructure (cli.run.pivotal.io and raw.githubusercontent.com), which are legitimate sources for the project; the binary is installed directly and no malicious activity is present, making this a standard AUR package with a minor trust concern due to the non-whitelisted host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 "cf-cli-${pkgver}-amd64.tar.gz::https://cli.run.pivotal.io/stable?release=linux64-binary&version=${pkgver}&source=github-rel"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AbrarSyed <aur _AT_ abrarsyed _DOT_ com>
    
      2pkgname=cloudfoundry-cli
    
      3pkgver=8.18.0
    
      4pkgrel=1
    
      5pkgdesc="The official command line client for Cloud Foundry"
    
      6arch=('x86_64')
    
      7url="https://github.com/cloudfoundry/cli"
    
      8license=('Apache')
    
      9provides=(cf)
    
      10options=('!emptydirs' '!strip')
    
      11
    
      12source=(
    
      13    "cf-cli-${pkgver}-amd64.tar.gz::https://cli.run.pivotal.io/stable?release=linux64-binary&version=${pkgver}&source=github-rel"
    
      14    "cf-cli-completion::https://raw.githubusercontent.com/cloudfoundry/cli-ci/master/ci/installers/completion/cf"
    
      15)
    
      16
    
      17md5sums=('1cbb9792d8a00f69eccb1fd20099812b'
    
      18         'b3dc7a45905e0dc58f3011f431befb90')
    
      19sha256sums=('d7f5f24eea21cd5d585b8504005ead5a67a2e6e3edddd5b51a3d1e70f595ba46'
    
      20            'f3f05a2414075c00b101b05f73cf260b9eec9966659adf2957c1b2937bd4c48e')
    
      21sha512sums=('5f8e94940b848b3bcffc2eae777afc3ed618382ec408a7f203d43182b5dae09861d0f4e6489251e4da288150c468b8f4260cf806a2d9bc1a72e21d583dd423ef'
    
      22            '016e999430d8c78ed06eb283f31ed601d6d6fb5ee2da9253f84e2364a13fe1723dfd9501f6bf53019ef6f1b54eb8e094e11564ed3d154a475a43321a99d080ef')
    
      23
    
      24package() {
    
      25    # copy binary
    
      26	mkdir -p "$pkgdir/usr/bin"
    
      27	install $srcdir/cf8 "$pkgdir/usr/bin"
    
      28	ln -s /usr/bin/cf8  "$pkgdir/usr/bin/cf"
    
      29
    
      30	# copy completion file, ripped from Pappy's CF6 PKGBUILD
    
      31	install -Dm644 cf-cli-completion $pkgdir/usr/share/bash-completion/completions/cf
    
      32
    
      33	#copy license & notice
    
      34	mkdir -p "$pkgdir/usr/share/doc/cf-cli"
    
      35	install $srcdir/LICENSE "$pkgdir/usr/share/doc/cf-cli/LICENSE"
    
      36	install $srcdir/NOTICE "$pkgdir/usr/share/doc/cf-cli/NOTICE"
    
      37}
    
      38
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2