dane-without-root
LOW
maintainer neowutran
0 votes
scanned 2026-10-03 00:23:04.761738
Why flagged
The 'cargo install cargo-c' in prepare() is used for building the package's own source via cargo-cinstall, not installing untrusted external binaries; this is a normal build-time dependency in the AUR context.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The 'cargo install cargo-c' in prepare() is used for building the package's own source via cargo-cinstall, not installing untrusted external binaries; this is a normal build-time dependency in the AUR context.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
External install via pipx/uv/poetry/cargo/go/gem
alt_pkg_manager_install
A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:39
cargo install cargo-c
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Neowutran <aur at neowutran dot ovh>
2
pkgname="dane-without-root"
3
backup=(etc/dane-proxy/dane-proxy.conf)
4
pkgver='0.1.41'
5
pkgrel=1
6
arch=('x86_64' 'i686' 'aarch64' 'armv7h' 'armv6h' 'riscv64')
7
pkgdesc="Provide multiples DANE tools that does not use the root '.' DNS server for validation"
8
url='https://sr.ht/~yukikoo/dane_without_root/'
9
license=(AGPL-3.0-or-later)
10
depends=(
11
dnssec-without-root
12
openssl
13
libgcc
14
glibc
15
)
16
optdepends=('start-stop-daemon: sysv support')
17
makedepends=(cargo git curl pkgconf openssl)
18
sha256sums=('ac8b2188f404e19b3957587601d28243ded8c13d16b75d8372bb593746f7db7e')
19
source=("git+https://git.sr.ht/~yukikoo/dane_without_root?signed#tag=dane-${pkgver}")
20
validpgpkeys=('FB798BFB115895C9C95900649C2B29DD4A62ED27')
21
backup=(
22
'etc/dane-proxy/dane-proxy.conf'
23
)
24
install='proxy_certificate.install'
25
26
# Use debug
27
export CARGO_PROFILE_RELEASE_DEBUG=2 CARGO_PROFILE_RELEASE_STRIP=false
28
29
# Use LTO
30
export CARGO_PROFILE_RELEASE_LTO=true CARGO_PROFILE_RELEASE_CODEGEN_UNITS=1
31
32
export RUSTUP_TOOLCHAIN=stable
33
export CARGO_TARGET_DIR=target
34
export CFLAGS+=' -ffat-lto-objects'
35
36
prepare() {
37
cd "$srcdir/dane_without_root"
38
cargo fetch --locked
39
cargo install cargo-c
40
}
41
build() {
42
cd "$srcdir/dane_without_root"
43
cargo build --frozen --release --bin dane-without-root-client --features client,logging,tofu
44
cargo build --frozen --release --bin dane-without-root-proxy --features proxy,logging,tofu
45
cargo cinstall --frozen --release --lib --features tofu --destdir=./target/release/ --prefix=/usr
46
}
47
check() {
48
cd "$srcdir/dane_without_root"
49
DANE_WITHOUT_ROOT_SYSTEM_VALID_DOMAIN_FILE=./implementation/valid_dane_domain.txt \
50
DNSSEC_WITHOUT_ROOT_DIRECTORY=./dnssec_keys/usr/share/dnssec-keys/ \
51
cargo test --frozen --release --features logging,capi,wrapper_rustls,wrapper_openssl,client,tofu
52
}
53
package() {
54
cd "$srcdir/dane_without_root/implementation/"
55
install -vDm 0644 dane-proxy.service -t "$pkgdir"/usr/lib/systemd/system
56
install -vDm 0644 dane-proxy.sysusers "$pkgdir"/usr/lib/sysusers.d/dane-proxy.conf
57
install -vDm 0644 dane-proxy.tmpfiles "$pkgdir"/usr/lib/tmpfiles.d/dane-proxy.conf
58
install -vDm 0644 dane-without-root-client.1 "$pkgdir"/usr/share/man/man1/dane-without-root-client.1
59
install -vDm 0644 dane-without-root-proxy.1 "$pkgdir"/usr/share/man/man1/dane-without-root-proxy.1
60
install -vDm 0755 -t "$pkgdir/etc/init.d/" "dane-proxy"
61
install -vDm 0755 -t "$pkgdir/usr/bin/" "../target/release/$pkgname-proxy"
62
install -vDm 0755 -t "$pkgdir/usr/bin/" "../target/release/$pkgname-client"
63
install -vDm 0644 -t "$pkgdir/usr/include/" ../target/release/usr/include/dane_without_root/dane_without_root.h
64
install -vDm 0644 -t "$pkgdir/usr/lib/" ../target/release/usr/lib/libdane_without_root.so.0.1.41
65
install -vDm 0644 -t "$pkgdir/usr/lib/" ../target/release/usr/lib/libdane_without_root.a
66
install -vDm 0644 -t "$pkgdir/usr/lib/pkgconfig/" ../target/release/usr/lib/pkgconfig/dane_without_root.pc
67
install -vdm 0755 "$pkgdir"/etc/dane-proxy
68
install -vDm 0644 dane-proxy.conf "$pkgdir"/etc/dane-proxy/dane-proxy.conf
69
install -vDm 0644 valid_dane_domain.txt -t "$pkgdir"/usr/share/dane-without-root
70
ln -sf "libdane_without_root.so.0.1.41" "$pkgdir/usr/lib/libdane_without_root.so.0.1"
71
ln -sf "libdane_without_root.so.0.1.41" "$pkgdir/usr/lib/libdane_without_root.so"
72
touch "$pkgdir/etc/dane-proxy/valid_dane_domain.txt"
73
touch "$pkgdir/etc/dane-proxy/known_hosts"
74
}
75
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-03 00:23:04 | Low | 2 |
| 2026-10-02 00:00:32 | Low | 2 |
| 2026-10-01 00:02:06 | Low | 2 |
| 2026-09-30 00:20:07 | Low | 2 |
| 2026-09-29 00:07:46 | Low | 2 |
| 2026-09-28 00:28:32 | Low | 2 |
| 2026-09-27 00:07:07 | Low | 2 |
| 2026-09-26 00:12:15 | Low | 2 |
| 2026-09-25 00:03:36 | Low | 2 |
| 2026-09-24 00:24:14 | Low | 2 |
| 2026-09-23 00:28:13 | Low | 2 |
| 2026-09-22 00:15:14 | Low | 2 |
| 2026-09-21 00:26:32 | Low | 2 |
| 2026-09-20 00:25:31 | Low | 2 |
| 2026-09-19 00:25:36 | Low | 2 |
| 2026-09-18 00:17:11 | Low | 2 |
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |