continuwuity-git

maintainer Kimiblock · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from source hosted on a non-whitelisted but plausibly project-owned forge; it does not execute untrusted prebuilt binaries or exfiltrate data.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source hosted on a non-whitelisted but plausibly project-owned forge; it does not execute untrusted prebuilt binaries or exfiltrate data.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("git+https://forgejo.ellis.link/continuwuation/continuwuity.git")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kimiblock Moe
    
      2
    
      3pkgname=continuwuity-git
    
      4pkgdesc="a very cool, featureful fork of conduit (rust matrix homeserver)"
    
      5url="https://forgejo.ellis.link/continuwuation/continuwuity"
    
      6license=("Apache-2.0")
    
      7arch=("x86_64" "aarch64")
    
      8pkgver=26.6.2.7386.geff454218
    
      9pkgrel=1
    
      10epoch=1
    
      11makedepends=("rust" "cargo" "git" "clang")
    
      12depends=("gcc-libs" "glibc" "liburing" "jemalloc" "zstd")
    
      13source=("git+https://forgejo.ellis.link/continuwuation/continuwuity.git")
    
      14sha256sums=(SKIP)
    
      15provides=("conduwuit" "continuwuity")
    
      16conflicts=("conduwuit" "continuwuity")
    
      17options=(!lto)
    
      18backup=("etc/conduwuit/conduwuit.toml")
    
      19
    
      20function pkgver() {
    
      21	cd continuwuity
    
      22	echo "$(grep '^version =' Cargo.toml|head -n1|cut -d\" -f2|cut -d\- -f1).$(git rev-list --count HEAD).g$(git rev-parse --short HEAD)"
    
      23}
    
      24
    
      25function prepare() {
    
      26	export JEMALLOC_OVERRIDE=/usr/lib/libjemalloc.so
    
      27	export CARGO_FEATURE_UNPREFIXED_MALLOC_ON_SUPPORTED_PLATFORMS=1
    
      28	export ZSTD_SYS_USE_PKG_CONFIG=1
    
      29	cd "${srcdir}/continuwuity"
    
      30	export RUSTUP_TOOLCHAIN=stable
    
      31	cargo fetch --locked --target host-tuple
    
      32	export CONDUWUIT_VERSION_EXTRA=$(git rev-parse --short HEAD)
    
      33}
    
      34
    
      35function build() {
    
      36	export JEMALLOC_OVERRIDE=/usr/lib/libjemalloc.so
    
      37	export CARGO_FEATURE_UNPREFIXED_MALLOC_ON_SUPPORTED_PLATFORMS=1
    
      38	export ZSTD_SYS_USE_PKG_CONFIG=1
    
      39	cd "${srcdir}/continuwuity"
    
      40	export RUSTUP_TOOLCHAIN=stable
    
      41	export CARGO_TARGET_DIR=target
    
      42	cargo build --frozen --release --locked
    
      43}
    
      44
    
      45function check() {
    
      46	export JEMALLOC_OVERRIDE=/usr/lib/libjemalloc.so
    
      47	export CARGO_FEATURE_UNPREFIXED_MALLOC_ON_SUPPORTED_PLATFORMS=1
    
      48	export ZSTD_SYS_USE_PKG_CONFIG=1
    
      49	cd "${srcdir}/continuwuity"
    
      50	export RUSTUP_TOOLCHAIN=stable
    
      51	cargo test --frozen --locked
    
      52}
    
      53
    
      54function package() {
    
      55	install -Dm755 "${srcdir}/continuwuity/target/release/conduwuit" "${pkgdir}/usr/bin/conduwuit"
    
      56	install -Dm644 "${srcdir}/continuwuity/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      57	install -Dm600 "${srcdir}/continuwuity/conduwuit-example.toml" "${pkgdir}/etc/conduwuit/conduwuit.toml"
    
      58	install -Dm644 "${srcdir}/continuwuity/pkg/conduwuit.service" "${pkgdir}/usr/lib/systemd/system/continuwuity.service"
    
      59}
    
      60

Changes since previous scan

--- PKGBUILD @ 2026-06-20 00:18
+++ PKGBUILD @ 2026-08-03 00:08
@@ -5,11 +5,11 @@
 url="https://forgejo.ellis.link/continuwuation/continuwuity"
 license=("Apache-2.0")
 arch=("x86_64" "aarch64")
-pkgver=0.5.4.6016.g19146166c
-pkgrel=2
+pkgver=26.6.2.7386.geff454218
+pkgrel=1
 epoch=1
 makedepends=("rust" "cargo" "git" "clang")
-depends=("gcc-libs" "glibc" "liburing" "jemalloc")
+depends=("gcc-libs" "glibc" "liburing" "jemalloc" "zstd")
 source=("git+https://forgejo.ellis.link/continuwuation/continuwuity.git")
 sha256sums=(SKIP)
 provides=("conduwuit" "continuwuity")
@@ -23,6 +23,9 @@
 }
 
 function prepare() {
+	export JEMALLOC_OVERRIDE=/usr/lib/libjemalloc.so
+	export CARGO_FEATURE_UNPREFIXED_MALLOC_ON_SUPPORTED_PLATFORMS=1
+	export ZSTD_SYS_USE_PKG_CONFIG=1
 	cd "${srcdir}/continuwuity"
 	export RUSTUP_TOOLCHAIN=stable
 	cargo fetch --locked --target host-tuple
@@ -30,6 +33,9 @@
 }
 
 function build() {
+	export JEMALLOC_OVERRIDE=/usr/lib/libjemalloc.so
+	export CARGO_FEATURE_UNPREFIXED_MALLOC_ON_SUPPORTED_PLATFORMS=1
+	export ZSTD_SYS_USE_PKG_CONFIG=1
 	cd "${srcdir}/continuwuity"
 	export RUSTUP_TOOLCHAIN=stable
 	export CARGO_TARGET_DIR=target
@@ -37,6 +43,9 @@
 }
 
 function check() {
+	export JEMALLOC_OVERRIDE=/usr/lib/libjemalloc.so
+	export CARGO_FEATURE_UNPREFIXED_MALLOC_ON_SUPPORTED_PLATFORMS=1
+	export ZSTD_SYS_USE_PKG_CONFIG=1
 	cd "${srcdir}/continuwuity"
 	export RUSTUP_TOOLCHAIN=stable
 	cargo test --frozen --locked

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 05:54:03	MEDIUM	1
2026-06-20 00:18:46	MEDIUM	1
2026-06-19 23:51:18	CLEAN	2