dane-without-root
maintainer neowutran
· 0 votes
· scanned 2026-08-18 00:03:42.021799
LOW
View on AUR ↗
Why flagged
The package builds from its own signed source repository on sr.ht with a verified PGP tag; the only flagged issue is `cargo install cargo-c` in prepare(), which fetches a well-known Cargo build tool from crates.io rather than an untrusted host, and the .install hook only generates a local self-signed TLS certificate using openssl — no remote code execution or exfiltration.
Triggered rules
LOW
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The package builds from its own signed source repository on sr.ht with a verified PGP tag; the only flagged issue is `cargo install cargo-c` in prepare(), which fetches a well-known Cargo build tool from crates.io rather than an untrusted host, and the .install hook only generates a local self-signed TLS certificate using openssl — no remote code execution or exfiltration.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
External install via pipx/uv/poetry/cargo/go/gem
alt_pkg_manager_install
A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:38
cargo install cargo-c
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Neowutran <aur at neowutran dot ovh>
2
pkgname="dane-without-root"
3
backup=(etc/dane-proxy/dane-proxy.conf)
4
pkgver='0.1.34'
5
pkgrel=1
6
arch=('x86_64' 'i686' 'aarch64' 'armv7h' 'armv6h' 'riscv64')
7
pkgdesc="Provide multiples DANE tools that does not use the root '.' DNS server for validation"
8
url='https://sr.ht/~yukikoo/dane_without_root/'
9
license=(AGPL-3.0-or-later)
10
depends=(
11
dnssec-without-root
12
openssl
13
libgcc
14
glibc
15
)
16
makedepends=(cargo git curl pkgconf openssl)
17
sha256sums=('03400a80c91e6adb59110b148b0deb2bbf58b05e20d7a9395c2aad567d3f4c27')
18
source=("git+https://git.sr.ht/~yukikoo/dane_without_root?signed#tag=dane-${pkgver}")
19
validpgpkeys=('FB798BFB115895C9C95900649C2B29DD4A62ED27')
20
backup=(
21
'etc/dane-proxy/dane-proxy.conf'
22
)
23
install='proxy_certificate.install'
24
25
# Use debug
26
export CARGO_PROFILE_RELEASE_DEBUG=2 CARGO_PROFILE_RELEASE_STRIP=false
27
28
# Use LTO
29
export CARGO_PROFILE_RELEASE_LTO=true CARGO_PROFILE_RELEASE_CODEGEN_UNITS=1
30
31
export RUSTUP_TOOLCHAIN=stable
32
export CARGO_TARGET_DIR=target
33
export CFLAGS+=' -ffat-lto-objects'
34
35
prepare() {
36
cd "$srcdir/dane_without_root"
37
cargo fetch --locked
38
cargo install cargo-c
39
}
40
build() {
41
cd "$srcdir/dane_without_root"
42
cargo build --frozen --release --bin dane-without-root-client --features client,logging,tofu
43
cargo build --frozen --release --bin dane-without-root-proxy --features proxy,logging,tofu
44
cargo cinstall --frozen --release --lib --features tofu --destdir=./target/release/ --prefix=/usr
45
}
46
check() {
47
cd "$srcdir/dane_without_root"
48
DANE_WITHOUT_ROOT_SYSTEM_VALID_DOMAIN_FILE=./implementation/valid_dane_domain.txt \
49
DNSSEC_WITHOUT_ROOT_DIRECTORY=./dnssec_keys/usr/share/dnssec-keys/ \
50
cargo test --frozen --release --features logging,capi,wrapper_rustls,wrapper_openssl,client,tofu
51
}
52
package() {
53
cd "$srcdir/dane_without_root/implementation/"
54
install -vDm 0644 dane-proxy.service -t "$pkgdir"/usr/lib/systemd/system
55
install -vDm 0644 dane-proxy.sysusers "$pkgdir"/usr/lib/sysusers.d/dane-proxy.conf
56
install -vDm 0644 dane-proxy.tmpfiles "$pkgdir"/usr/lib/tmpfiles.d/dane-proxy.conf
57
install -vDm 0644 dane-without-root-client.1 "$pkgdir"/usr/share/man/man1/dane-without-root-client.1
58
install -vDm 0644 dane-without-root-proxy.1 "$pkgdir"/usr/share/man/man1/dane-without-root-proxy.1
59
install -vDm 0755 -t "$pkgdir/usr/bin/" "../target/release/$pkgname-proxy"
60
install -vDm 0755 -t "$pkgdir/usr/bin/" "../target/release/$pkgname-client"
61
install -vDm 0644 -t "$pkgdir/usr/include/" ../target/release/usr/include/dane_without_root/dane_without_root.h
62
install -vDm 0644 -t "$pkgdir/usr/lib/" ../target/release/usr/lib/libdane_without_root.so.0.1.34
63
install -vDm 0644 -t "$pkgdir/usr/lib/" ../target/release/usr/lib/libdane_without_root.a
64
install -vDm 0644 -t "$pkgdir/usr/lib/pkgconfig/" ../target/release/usr/lib/pkgconfig/dane_without_root.pc
65
install -vdm 0755 "$pkgdir"/etc/dane-proxy
66
install -vDm 0644 dane-proxy.conf "$pkgdir"/etc/dane-proxy/dane-proxy.conf
67
install -vDm 0644 valid_dane_domain.txt -t "$pkgdir"/usr/share/dane-without-root
68
ln -sf "/usr/lib/libdane_without_root.so.0.1.34" "$pkgdir/usr/lib/libdane_without_root.so.0.1"
69
ln -sf "/usr/lib/libdane_without_root.so.0.1.34" "$pkgdir/usr/lib/libdane_without_root.so"
70
touch "$pkgdir/etc/dane-proxy/valid_dane_domain.txt"
71
touch "$pkgdir/etc/dane-proxy/known_hosts"
72
}
73
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-18 00:03:42 | LOW | 3 |
| 2026-08-17 00:18:29 | LOW | 3 |
| 2026-08-16 00:03:42 | LOW | 3 |
| 2026-08-15 00:26:13 | LOW | 3 |
| 2026-08-14 00:03:41 | LOW | 3 |
| 2026-08-13 00:17:07 | LOW | 3 |
| 2026-08-12 00:27:08 | LOW | 3 |
| 2026-08-11 23:24:43 | LOW | 3 |
| 2026-08-11 23:21:47 | MEDIUM | 2 |