distrobuilder-git
LOW
maintainer andreas_baumann
1 votes
scanned 2026-10-02 00:00:32.890515
Why flagged
The source is a git clone from the project's official GitHub repository, which is a normal and safe practice for -git AUR packages, despite the host not being on a whitelist.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git clone from the project's official GitHub repository, which is a normal and safe practice for -git AUR packages, despite the host not being on a whitelist.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:18
source=($_pkgname::git+https://$_url)
PKGBUILD
1 offending line(s) highlighted
1
# Contributor: edacval <edacval AT gmail DOT com>
2
# Contributor: George Rawlinson <george@rawlinson.net.nz>
3
# Contributor: Stéphane Graber <stgraber AT ubuntu DOT com>
4
# Contributor: graysky <graysky AT archlinux DOT us>
5
6
_pkgname=distrobuilder
7
_url=github.com/lxc/$_pkgname
8
pkgname=$_pkgname-git
9
pkgver=v3.3.1.r48.gf2c2434
10
pkgrel=1
11
pkgdesc="System container image builder for LXC and LXD"
12
arch=(x86_64)
13
url="https://$_url"
14
license=(Apache)
15
depends=(rsync squashfs-tools gnupg debootstrap)
16
conflicts=(distrobuilder)
17
makedepends=(go git btrfs-progs)
18
source=($_pkgname::git+https://$_url)
19
sha256sums=('SKIP')
20
21
pkgver() {
22
cd $_pkgname
23
git describe --long | sed 's/^distrobuilder-//;s/\([^-]*-g\)/r\1/;s/-/./g'
24
}
25
26
prepare() {
27
# export & create $GOPATH
28
export GOPATH="$srcdir/go"
29
mkdir -p "$GOPATH"
30
31
# download dependencies
32
cd "$_pkgname"
33
go mod vendor
34
}
35
36
build() {
37
# export various Go flags
38
export GOPATH="$srcdir/go"
39
export CGO_CPPFLAGS="$CPPFLAGS"
40
export CGO_CFLAGS="$CFLAGS"
41
export CGO_CXXFLAGS="$CXXFLAGS"
42
export CGO_LDFLAGS="$LDFLAGS"
43
export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
44
45
# build binary
46
cd "$_pkgname"
47
go install -v ./...
48
}
49
50
check() {
51
export GOPATH="$srcdir/go"
52
cd "$_pkgname"
53
go test -v ./...
54
go vet -v ./...
55
}
56
57
package() {
58
install -Dm755 "$srcdir/go/bin/$_pkgname" -t "$pkgdir/usr/bin"
59
}
60
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-02 00:00:32 | Low | 2 |
| 2026-10-01 00:02:06 | Low | 2 |
| 2026-09-30 00:20:07 | Low | 2 |
| 2026-09-29 00:07:46 | Low | 2 |
| 2026-09-28 00:28:32 | Low | 2 |
| 2026-09-27 00:07:07 | Low | 2 |
| 2026-09-26 00:12:15 | Low | 2 |
| 2026-09-25 00:03:36 | Low | 2 |
| 2026-09-24 00:24:14 | Low | 2 |
| 2026-09-23 00:28:13 | Low | 2 |
| 2026-09-22 00:15:14 | Low | 2 |
| 2026-09-21 00:26:32 | Low | 2 |
| 2026-09-20 00:25:31 | Low | 2 |
| 2026-09-19 00:25:36 | Low | 2 |
| 2026-09-18 00:17:11 | Low | 2 |
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |