cvs-feature

maintainer meatlotion · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads the main source from a non-whitelisted but official GNU FTP mirror and a Debian patch from a known Debian repository; both are legitimate project sources, and the build process applies standard patches and compiles from source, posing no execution of untrusted binaries or malicious payloads.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads the main source from a non-whitelisted but official GNU FTP mirror and a Debian patch from a known Debian repository; both are legitimate project sources, and the build process applies standard patches and compiles from source, posing no execution of untrusted binaries or malicious payloads.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 http://http.debian.net/debian/pool/main/c/cvs/cvs_1.12.13+real-15+deb8u1.diff.gz

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: felix
    
      2# Originally based on the cvs package from ABS
    
      3# Maintainer: Lukas Fleischer <lfleischer@archlinux.org>
    
      4# Contributor: dorphell <dorphell@archlinux.org>
    
      5# Contributor: Dan McGee <dan@archlinux.org>
    
      6# Contributor: MeaTLoTioN <ml@erb.pw>
    
      7
    
      8pkgname=cvs-feature
    
      9pkgver=1.12.13
    
      10pkgrel=2
    
      11pkgdesc="Concurrent Versions System - a source control system (\"feature\" release series, with Debian patches)"
    
      12arch=(i686 x86_64)
    
      13provides=(cvs)
    
      14conflicts=(cvs)
    
      15url="http://cvs.nongnu.org/"
    
      16license=('GPL')
    
      17depends=('krb5' 'zlib' 'libbsd')
    
      18optdepends=('openssh: for using cvs over ssh'
    
      19            'inetutils: for using cvs over rsh')
    
      20source=(
    
      21    ftp://ftp.gnu.org/non-gnu/cvs/source/feature/${pkgver}/cvs-${pkgver}.tar.bz2{,.sig}
    
      22    http://http.debian.net/debian/pool/main/c/cvs/cvs_1.12.13+real-15+deb8u1.diff.gz
    
      23)
    
      24sha512sums=(
    
      25    '7d10f808de62190b18d4f706d2d03ab218a508bfb52047ff3e830e293ec40c5e8bf6cc743ef72a5c24be5aa867c9e4892d7d475a026a98b296a3764b4bd0f4d8'
    
      26    'SKIP'
    
      27    'e6a0295624bdee01c3a2cac0f81113d049b82dc51aa67d100263f0e8eb95e2b84e6bc9166025e2ff0429b49862f8f49c1a6e5cb02990e470ea75805d52c1245d'
    
      28)
    
      29validpgpkeys=('CB6A07CA90C54234E8A3C8D02C3D4E4C17F231A4') # Derek R. Price <moc tod toibmix ta kered>
    
      30
    
      31prepare() {
    
      32  cd "${srcdir}/cvs-${pkgver}"
    
      33  patch -Np1 < ../cvs_1.12.13+real-15+deb8u1.diff
    
      34  sed -i -e 's/AM_CONFIG_HEADER/AC_CONFIG_HEADERS/' configure.in
    
      35  find . -name Makefile.am | xargs sed -i -e 's/^INCLUDES/AM_CPPFLAGS/'
    
      36}
    
      37
    
      38build() {
    
      39  cd "${srcdir}/cvs-${pkgver}"
    
      40  unset EDITOR VISUAL
    
      41
    
      42  AUTOMAKE='automake --add-missing' autoreconf
    
      43  ./configure LIBS="-lbsd" --prefix=/usr \
    
      44    --with-editor=/usr/bin/vi \
    
      45    --with-external-zlib
    
      46  make
    
      47}
    
      48
    
      49package() {
    
      50  cd "${srcdir}/cvs-${pkgver}"
    
      51
    
      52  make DESTDIR="${pkgdir}" install
    
      53  rm "${pkgdir}"/usr/share/info/dir
    
      54}
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2