distrobuilder-git
maintainer andreas_baumann
· 1 votes
· scanned 2026-08-18 00:03:42.021799
LOW
View on AUR ↗
Why flagged
The source is a git clone from the project's official GitHub repository, which is a normal and safe practice for -git AUR packages, despite the host not being on a whitelist.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git clone from the project's official GitHub repository, which is a normal and safe practice for -git AUR packages, despite the host not being on a whitelist.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:18
source=($_pkgname::git+https://$_url)
PKGBUILD
1 offending line(s) highlighted
1
# Contributor: edacval <edacval AT gmail DOT com>
2
# Contributor: George Rawlinson <george@rawlinson.net.nz>
3
# Contributor: Stéphane Graber <stgraber AT ubuntu DOT com>
4
# Contributor: graysky <graysky AT archlinux DOT us>
5
6
_pkgname=distrobuilder
7
_url=github.com/lxc/$_pkgname
8
pkgname=$_pkgname-git
9
pkgver=v3.3.1.r48.gf2c2434
10
pkgrel=1
11
pkgdesc="System container image builder for LXC and LXD"
12
arch=(x86_64)
13
url="https://$_url"
14
license=(Apache)
15
depends=(rsync squashfs-tools gnupg debootstrap)
16
conflicts=(distrobuilder)
17
makedepends=(go git btrfs-progs)
18
source=($_pkgname::git+https://$_url)
19
sha256sums=('SKIP')
20
21
pkgver() {
22
cd $_pkgname
23
git describe --long | sed 's/^distrobuilder-//;s/\([^-]*-g\)/r\1/;s/-/./g'
24
}
25
26
prepare() {
27
# export & create $GOPATH
28
export GOPATH="$srcdir/go"
29
mkdir -p "$GOPATH"
30
31
# download dependencies
32
cd "$_pkgname"
33
go mod vendor
34
}
35
36
build() {
37
# export various Go flags
38
export GOPATH="$srcdir/go"
39
export CGO_CPPFLAGS="$CPPFLAGS"
40
export CGO_CFLAGS="$CFLAGS"
41
export CGO_CXXFLAGS="$CXXFLAGS"
42
export CGO_LDFLAGS="$LDFLAGS"
43
export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
44
45
# build binary
46
cd "$_pkgname"
47
go install -v ./...
48
}
49
50
check() {
51
export GOPATH="$srcdir/go"
52
cd "$_pkgname"
53
go test -v ./...
54
go vet -v ./...
55
}
56
57
package() {
58
install -Dm755 "$srcdir/go/bin/$_pkgname" -t "$pkgdir/usr/bin"
59
}
60
Changes since previous scan
--- PKGBUILD @ 2026-06-19 19:07+++ PKGBUILD @ 2026-08-18 00:03@@ -6,7 +6,7 @@ _pkgname=distrobuilder _url=github.com/lxc/$_pkgname pkgname=$_pkgname-git-pkgver=2.1.r34.g2ff2379+pkgver=v3.3.1.r48.gf2c2434 pkgrel=1 pkgdesc="System container image builder for LXC and LXD" arch=(x86_64)@@ -14,7 +14,7 @@ license=(Apache) depends=(rsync squashfs-tools gnupg debootstrap) conflicts=(distrobuilder)-makedepends=(go git)+makedepends=(go git btrfs-progs) source=($_pkgname::git+https://$_url) sha256sums=('SKIP') Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-18 00:03:42 | LOW | 2 |
| 2026-08-17 00:18:29 | LOW | 2 |
| 2026-08-16 00:03:42 | LOW | 2 |
| 2026-08-15 00:26:13 | LOW | 2 |
| 2026-08-14 00:03:41 | LOW | 2 |
| 2026-08-13 00:17:07 | LOW | 2 |
| 2026-08-12 00:27:08 | LOW | 2 |
| 2026-08-11 17:21:34 | MEDIUM | 1 |
| 2026-06-19 19:07:35 | CLEAN | 2 |
| 2026-06-18 16:11:54 | MEDIUM | 1 |