exman

MEDIUM

maintainer stepnem 2 votes scanned 2026-10-20 19:28:13.414480

View on AUR

Why flagged

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://git.causal.agency/$pkgname/snapshot/$pkgname-$pkgver.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# shellcheck disable=SC2034 # unused var
    
      2# shellcheck disable=SC2164 # cd might fail
    
      3# Maintainer: Štěpán Němec <stepnem@smrk.net>
    
      4
    
      5pkgname=exman
    
      6pkgver=2083.38
    
      7pkgrel=1
    
      8pkgdesc="manuals for other systems"
    
      9arch=(any)
    
      10url="https://git.causal.agency/$pkgname"
    
      11license=(ISC)
    
      12depends=(man sh)
    
      13makedepends=(bmake git)
    
      14source=("https://git.causal.agency/$pkgname/snapshot/$pkgname-$pkgver.tar.gz")
    
      15sha256sums=('c11b57bf19c6a3a2438875ffd231e3afeba802a68bdc6a2794d001e444a8c179')
    
      16# zipman autocompression took 40m(!?) on my machine (4-core i7),
    
      17# parallelized and all (compared to ~20s with the custom package()
    
      18# below)
    
      19# the other options prevent searching for stuff that doesn't exist,
    
      20# leading to further speedup
    
      21options=(libtool staticlibs !strip !zipman)
    
      22
    
      23prepare() {
    
      24  cd "$pkgname-$pkgver"
    
      25  # these two are better obtained via the 'man-pages' package, exclude
    
      26  # them
    
      27  sed -i -e '/^SYSTEMS += \(Linux\|POSIX\)/d' Makefile
    
      28}
    
      29
    
      30build() {
    
      31  cd "$pkgname-$pkgver"
    
      32  bmake PREFIX=/usr TAR=bsdtar
    
      33}
    
      34
    
      35package() {
    
      36  cd "$pkgname-$pkgver"
    
      37  # shellcheck disable=SC2154
    
      38  bmake DESTDIR="$pkgdir"/ PREFIX=/usr TAR=bsdtar install
    
      39
    
      40  find "$pkgdir" -empty -delete
    
      41
    
      42  # macOS ships two perl(1) man pages...?
    
      43  if [[ -f "$pkgdir"/usr/share/exman/macOS/man1/perl.1.gz &&
    
      44          -f "$pkgdir"/usr/share/exman/macOS/man1/perl.1 ]]; then
    
      45    echo 'Removing stray macOS perl.1 man page...'
    
      46    rm "$pkgdir"/usr/share/exman/macOS/man1/perl.1.gz
    
      47    echo 'Removing stray macOS perl.1 man page...done'
    
      48  fi
    
      49
    
      50  echo 'Compressing uncompressed man pages...'
    
      51  find "$pkgdir"/usr/share/{,ex}man -type f ! -name '*.gz' \
    
      52       -exec gzip --best '{}' + 2>&1 | tee log
    
      53  echo 'Compressing uncompressed man pages...done'
    
      54
    
      55  # gzip (still) can't handle links...?
    
      56  # cf. e.g. http://www.argon.org/~roderick/gzip-links
    
      57  echo 'Compressing and fixing multiply (hard-)linked files...'
    
      58  local -a sources
    
      59  local inode path sOurce
    
      60  sed -ne "s/^gzip: '\{,1\}\([^']*\)'\{,1\} has [^ ]\{1,\} other link.*$/\1/p" log |
    
      61    while IFS= read -r path; do
    
      62      inode=$(stat --printf='%i' "$path")
    
      63      sOurce=${sources[$inode]}
    
      64      if [[ -n "$sOurce" ]]; then
    
      65        # we've already compressed one of the links; just link to it
    
      66        # from the other path(s)
    
      67        ln "$sOurce" "$path".gz
    
      68        rm "$path"
    
      69      elif gzip --best --force "$path"; then
    
      70        sources[$inode]=$path.gz
    
      71      else
    
      72        printf 'WARNING: failed to compress %s\n' "$path"
    
      73      fi
    
      74    done
    
      75  echo 'Compressing and fixing multiply (hard-)linked files...done'
    
      76
    
      77  echo 'Fixing symbolic links...'
    
      78  # re-link to the newly compressed targets
    
      79  find "$pkgdir"/usr/share/{,ex}man -xtype l -exec \
    
      80       sh -c 'ln -sf "$(readlink "$1")".gz "$1".gz && rm "$1"' sh {} \;
    
      81  echo 'Fixing symbolic links...done'
    
      82
    
      83  install -dm755 "$pkgdir"/usr/share/licenses/"$pkgname"
    
      84  sed -ne '/^# Copyright (C) /,/^# PERFORMANCE OF THIS / p' exman.in \
    
      85      >"$pkgdir"/usr/share/licenses/"$pkgname"/LICENSE
    
      86
    
      87  chown -R root:root "$pkgdir"
    
      88}
    
      89

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-10-20 19:28
@@ -3,7 +3,7 @@
 # Maintainer: Štěpán Němec <stepnem@smrk.net>
 
 pkgname=exman
-pkgver=2082.16
+pkgver=2083.38
 pkgrel=1
 pkgdesc="manuals for other systems"
 arch=(any)
@@ -12,7 +12,7 @@
 depends=(man sh)
 makedepends=(bmake git)
 source=("https://git.causal.agency/$pkgname/snapshot/$pkgname-$pkgver.tar.gz")
-sha256sums=('253ef8a7a52655d7e4fca03b9d9f830a93438c6a594b77e8a812906e8d61bec1')
+sha256sums=('c11b57bf19c6a3a2438875ffd231e3afeba802a68bdc6a2794d001e444a8c179')
 # zipman autocompression took 40m(!?) on my machine (4-core i7),
 # parallelized and all (compared to ~20s with the custom package()
 # below)
@@ -57,7 +57,7 @@
   echo 'Compressing and fixing multiply (hard-)linked files...'
   local -a sources
   local inode path sOurce
-  sed -ne 's/^gzip: \(.*\) has [^ ]\{1,\} other link.*$/\1/p' log |
+  sed -ne "s/^gzip: '\{,1\}\([^']*\)'\{,1\} has [^ ]\{1,\} other link.*$/\1/p" log |
     while IFS= read -r path; do
       inode=$(stat --printf='%i' "$path")
       sOurce=${sources[$inode]}

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-20 19:28:13	Medium	1
2026-06-19 19:07:35	Clean	2
2026-06-18 16:11:54	Medium	1