cloudfoundry-cli

LOW

maintainer AbrarSyed 16 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt binary and a completion script from Cloud Foundry's official infrastructure (cli.run.pivotal.io and raw.githubusercontent.com), which are legitimate sources for the project; the binary is installed directly and no malicious activity is present, making this a standard AUR package with a minor trust concern due to the non-whitelisted host.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary and a completion script from Cloud Foundry's official infrastructure (cli.run.pivotal.io and raw.githubusercontent.com), which are legitimate sources for the project; the binary is installed directly and no malicious activity is present, making this a standard AUR package with a minor trust concern due to the non-whitelisted host.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 "cf-cli-${pkgver}-amd64.tar.gz::https://cli.run.pivotal.io/stable?release=linux64-binary&version=${pkgver}&source=github-rel"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AbrarSyed <aur _AT_ abrarsyed _DOT_ com>
    
      2pkgname=cloudfoundry-cli
    
      3pkgver=8.18.0
    
      4pkgrel=1
    
      5pkgdesc="The official command line client for Cloud Foundry"
    
      6arch=('x86_64')
    
      7url="https://github.com/cloudfoundry/cli"
    
      8license=('Apache')
    
      9provides=(cf)
    
      10options=('!emptydirs' '!strip')
    
      11
    
      12source=(
    
      13    "cf-cli-${pkgver}-amd64.tar.gz::https://cli.run.pivotal.io/stable?release=linux64-binary&version=${pkgver}&source=github-rel"
    
      14    "cf-cli-completion::https://raw.githubusercontent.com/cloudfoundry/cli-ci/master/ci/installers/completion/cf"
    
      15)
    
      16
    
      17md5sums=('1cbb9792d8a00f69eccb1fd20099812b'
    
      18         'b3dc7a45905e0dc58f3011f431befb90')
    
      19sha256sums=('d7f5f24eea21cd5d585b8504005ead5a67a2e6e3edddd5b51a3d1e70f595ba46'
    
      20            'f3f05a2414075c00b101b05f73cf260b9eec9966659adf2957c1b2937bd4c48e')
    
      21sha512sums=('5f8e94940b848b3bcffc2eae777afc3ed618382ec408a7f203d43182b5dae09861d0f4e6489251e4da288150c468b8f4260cf806a2d9bc1a72e21d583dd423ef'
    
      22            '016e999430d8c78ed06eb283f31ed601d6d6fb5ee2da9253f84e2364a13fe1723dfd9501f6bf53019ef6f1b54eb8e094e11564ed3d154a475a43321a99d080ef')
    
      23
    
      24package() {
    
      25    # copy binary
    
      26	mkdir -p "$pkgdir/usr/bin"
    
      27	install $srcdir/cf8 "$pkgdir/usr/bin"
    
      28	ln -s /usr/bin/cf8  "$pkgdir/usr/bin/cf"
    
      29
    
      30	# copy completion file, ripped from Pappy's CF6 PKGBUILD
    
      31	install -Dm644 cf-cli-completion $pkgdir/usr/share/bash-completion/completions/cf
    
      32
    
      33	#copy license & notice
    
      34	mkdir -p "$pkgdir/usr/share/doc/cf-cli"
    
      35	install $srcdir/LICENSE "$pkgdir/usr/share/doc/cf-cli/LICENSE"
    
      36	install $srcdir/NOTICE "$pkgdir/usr/share/doc/cf-cli/NOTICE"
    
      37}
    
      38
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2