cvs-feature

LOW

maintainer meatlotion 3 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads the main source from a non-whitelisted but official GNU FTP mirror and a Debian patch from a known Debian repository; both are legitimate project sources, and the build process applies standard patches and compiles from source, posing no execution of untrusted binaries or malicious payloads.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads the main source from a non-whitelisted but official GNU FTP mirror and a Debian patch from a known Debian repository; both are legitimate project sources, and the build process applies standard patches and compiles from source, posing no execution of untrusted binaries or malicious payloads.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 http://http.debian.net/debian/pool/main/c/cvs/cvs_1.12.13+real-15+deb8u1.diff.gz

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: felix
    
      2# Originally based on the cvs package from ABS
    
      3# Maintainer: Lukas Fleischer <lfleischer@archlinux.org>
    
      4# Contributor: dorphell <dorphell@archlinux.org>
    
      5# Contributor: Dan McGee <dan@archlinux.org>
    
      6# Contributor: MeaTLoTioN <ml@erb.pw>
    
      7
    
      8pkgname=cvs-feature
    
      9pkgver=1.12.13
    
      10pkgrel=2
    
      11pkgdesc="Concurrent Versions System - a source control system (\"feature\" release series, with Debian patches)"
    
      12arch=(i686 x86_64)
    
      13provides=(cvs)
    
      14conflicts=(cvs)
    
      15url="http://cvs.nongnu.org/"
    
      16license=('GPL')
    
      17depends=('krb5' 'zlib' 'libbsd')
    
      18optdepends=('openssh: for using cvs over ssh'
    
      19            'inetutils: for using cvs over rsh')
    
      20source=(
    
      21    ftp://ftp.gnu.org/non-gnu/cvs/source/feature/${pkgver}/cvs-${pkgver}.tar.bz2{,.sig}
    
      22    http://http.debian.net/debian/pool/main/c/cvs/cvs_1.12.13+real-15+deb8u1.diff.gz
    
      23)
    
      24sha512sums=(
    
      25    '7d10f808de62190b18d4f706d2d03ab218a508bfb52047ff3e830e293ec40c5e8bf6cc743ef72a5c24be5aa867c9e4892d7d475a026a98b296a3764b4bd0f4d8'
    
      26    'SKIP'
    
      27    'e6a0295624bdee01c3a2cac0f81113d049b82dc51aa67d100263f0e8eb95e2b84e6bc9166025e2ff0429b49862f8f49c1a6e5cb02990e470ea75805d52c1245d'
    
      28)
    
      29validpgpkeys=('CB6A07CA90C54234E8A3C8D02C3D4E4C17F231A4') # Derek R. Price <moc tod toibmix ta kered>
    
      30
    
      31prepare() {
    
      32  cd "${srcdir}/cvs-${pkgver}"
    
      33  patch -Np1 < ../cvs_1.12.13+real-15+deb8u1.diff
    
      34  sed -i -e 's/AM_CONFIG_HEADER/AC_CONFIG_HEADERS/' configure.in
    
      35  find . -name Makefile.am | xargs sed -i -e 's/^INCLUDES/AM_CPPFLAGS/'
    
      36}
    
      37
    
      38build() {
    
      39  cd "${srcdir}/cvs-${pkgver}"
    
      40  unset EDITOR VISUAL
    
      41
    
      42  AUTOMAKE='automake --add-missing' autoreconf
    
      43  ./configure LIBS="-lbsd" --prefix=/usr \
    
      44    --with-editor=/usr/bin/vi \
    
      45    --with-external-zlib
    
      46  make
    
      47}
    
      48
    
      49package() {
    
      50  cd "${srcdir}/cvs-${pkgver}"
    
      51
    
      52  make DESTDIR="${pkgdir}" install
    
      53  rm "${pkgdir}"/usr/share/info/dir
    
      54}
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2