cssh

LOW

maintainer andreas_baumann 1 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The source is a git repository hosted on the maintainer's own domain, which is plausibly the project's official source; building from a non-whitelisted host is normal for AUR packages and not inherently dangerous.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git repository hosted on the maintainer's own domain, which is plausibly the project's official source; building from a non-whitelisted host is normal for AUR packages and not inherently dangerous.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("git+https://git.andreasbaumann.cc/cgit/cssh#branch=master")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Andreas Baumann <mail at andreasbaumann dot cc>
    
      2pkgname=cssh
    
      3pkgver=0.0.1.r25.g6bd0546
    
      4pkgrel=2
    
      5pkgdesc="Cluster Secure Shell/Copy based on libssh, for managing clusters in parallel"
    
      6arch=('i486' 'i686' 'pentium4' 'x86_64' 'armv6h' 'armv7h' 'aarch64')
    
      7url="https://git.andreasbaumann.cc/cgit/cssh/"
    
      8license=('GPL-3.0-or-later')
    
      9depends=('libssh' 'ncurses')
    
      10makedepends=('git' 'cmake' 'gengetopt')
    
      11checkdepends=('openssh' 'inetutils')
    
      12provides=('cscp')
    
      13source=("git+https://git.andreasbaumann.cc/cgit/cssh#branch=master")
    
      14sha256sums=('SKIP')
    
      15
    
      16pkgver() {
    
      17	cd "$pkgname"
    
      18	git describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      19}
    
      20
    
      21build() {
    
      22	cmake -B build -S "$pkgname" \
    
      23		-DCMAKE_INSTALL_PREFIX=/usr \
    
      24		-DCMAKE_BUILD_TYPE=Release
    
      25	cmake --build build
    
      26}
    
      27
    
      28check() {
    
      29	# CsshFunctional needs a real SSH identity for ssh_userauth_publickey_auto() to offer; the build user's $HOME starts with none.
    
      30	mkdir -p "$HOME/.ssh"
    
      31	[ -f "$HOME/.ssh/id_rsa" ] || ssh-keygen -t rsa -b 2048 -f "$HOME/.ssh/id_rsa" -N "" -q
    
      32	ctest --test-dir build --output-on-failure
    
      33}
    
      34
    
      35package() {
    
      36	DESTDIR="$pkgdir" cmake --install build
    
      37
    
      38	install -Dm644 "$pkgname/man/cssh.1" "$pkgdir/usr/share/man/man1/cssh.1"
    
      39	install -Dm644 "$pkgname/man/cscp.1" "$pkgdir/usr/share/man/man1/cscp.1"
    
      40
    
      41	install -Dm644 "$pkgname/COPYING" "$pkgdir/usr/share/licenses/$pkgname/COPYING"
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 00:11:52	Low	2
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 00:13:36	Low	2
2026-10-05 00:08:03	Low	2
2026-10-04 00:18:08	Low	2
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2