fake-gcs-server

MEDIUM

maintainer Smoolak 0 votes scanned 2026-09-20 17:33:19.607430

View on AUR

Why flagged

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

Triggered rules

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:64 curl -fsS 'http://127.0.0.1:4443/storage/v1/b/sample-bucket/o' \

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Smoolak <smoolak@gmail.com>
    
      2# Contributor: Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
    
      3
    
      4pkgname="fake-gcs-server"
    
      5pkgver=1.56.1
    
      6pkgrel=1
    
      7pkgdesc="Google Cloud Storage emulator & testing library"
    
      8arch=('aarch64' 'x86_64')
    
      9url="https://github.com/fsouza/${pkgname}"
    
      10license=('BSD-2-Clause')
    
      11depends=('glibc')
    
      12makedepends=('go>=2:1.26')
    
      13checkdepends=('curl')
    
      14_pkgsrc="${pkgname}-${pkgver}"
    
      15source=("${_pkgsrc}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz")
    
      16sha256sums=('a322297f949d5339a8e521eb15a35b80c8023f970b0f6511a7bb84e72932ca2c')
    
      17
    
      18prepare() {
    
      19  cd "${srcdir}/${_pkgsrc}"
    
      20  mkdir -p "build"
    
      21}
    
      22
    
      23build() {
    
      24  cd "${srcdir}/${_pkgsrc}"
    
      25  export CGO_CPPFLAGS="${CPPFLAGS}"
    
      26  export CGO_CFLAGS="${CFLAGS}"
    
      27  export CGO_CXXFLAGS="${CXXFLAGS}"
    
      28  export CGO_LDFLAGS="${LDFLAGS}"
    
      29  export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
    
      30  # Use Arch's compiler; never download a prebuilt toolchain implicitly.
    
      31  export GOTOOLCHAIN=local
    
      32  go build -v -o "build/${pkgname}" .
    
      33}
    
      34
    
      35check() {
    
      36  cd "${srcdir}/${_pkgsrc}"
    
      37
    
      38  # Fetch test-only module sources while the outbound proxy is still active.
    
      39  # The ordinary build only fetched modules imported by the server binary.
    
      40  export GOTOOLCHAIN=local
    
      41  go mod download
    
      42
    
      43  # Keep loopback requests in the tests and functional probe off outbound proxies.
    
      44  unset http_proxy https_proxy HTTP_PROXY HTTPS_PROXY all_proxy ALL_PROXY
    
      45  export NO_PROXY='127.0.0.1,localhost'
    
      46  export GOTOOLCHAIN=local
    
      47
    
      48  go test ./...
    
      49
    
      50  local runtime_dir="${srcdir}/runtime" server_pid
    
      51  rm -rf "${runtime_dir}"
    
      52  install -d "${runtime_dir}/data/sample-bucket" "${runtime_dir}/storage"
    
      53  printf 'source-built emulator\n' > \
    
      54    "${runtime_dir}/data/sample-bucket/proof.txt"
    
      55  "build/${pkgname}" -scheme http -host 127.0.0.1 -port 4443 \
    
      56    -filesystem-root "${runtime_dir}/storage" \
    
      57    -data "${runtime_dir}/data" >"${runtime_dir}/server.log" 2>&1 &
    
      58  server_pid=$!
    
      59  trap 'kill "${server_pid}" 2>/dev/null || true' RETURN
    
      60
    
      61  curl --retry 30 --retry-connrefused --retry-delay 0 -fsS \
    
      62    'http://127.0.0.1:4443/storage/v1/b' >"${runtime_dir}/buckets.json"
    
      63  grep -Fq 'sample-bucket' "${runtime_dir}/buckets.json"
    
      64  curl -fsS 'http://127.0.0.1:4443/storage/v1/b/sample-bucket/o' \
    
      65    >"${runtime_dir}/objects.json"
    
      66  grep -Fq 'proof.txt' "${runtime_dir}/objects.json"
    
      67  curl -fsS \
    
      68    'http://127.0.0.1:4443/download/storage/v1/b/sample-bucket/o/proof.txt?alt=media' \
    
      69    >"${runtime_dir}/proof.txt"
    
      70  grep -Fxq 'source-built emulator' "${runtime_dir}/proof.txt"
    
      71
    
      72  kill "${server_pid}"
    
      73  wait "${server_pid}" || true
    
      74  trap - RETURN
    
      75}
    
      76
    
      77package() {
    
      78  cd "${srcdir}/${_pkgsrc}"
    
      79  install -vDm755 "build/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      80  install -vDm644 "README.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      81  install -vDm644 "LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      82}
    
      83

Changes since previous scan

--- PKGBUILD @ 2026-07-24 00:02
+++ PKGBUILD @ 2026-09-20 17:33
@@ -1,17 +1,19 @@
-# Maintainer:  Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
+# Maintainer: Smoolak <smoolak@gmail.com>
+# Contributor: Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
 
 pkgname="fake-gcs-server"
-pkgver=1.52.2
+pkgver=1.56.1
 pkgrel=1
 pkgdesc="Google Cloud Storage emulator & testing library"
 arch=('aarch64' 'x86_64')
 url="https://github.com/fsouza/${pkgname}"
 license=('BSD-2-Clause')
 depends=('glibc')
-makedepends=('go')
+makedepends=('go>=2:1.26')
+checkdepends=('curl')
 _pkgsrc="${pkgname}-${pkgver}"
 source=("${_pkgsrc}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz")
-sha256sums=('72286d7db3b9b08c64821dff758baba0b9836876c8f553d281974dfb5525f65e')
+sha256sums=('a322297f949d5339a8e521eb15a35b80c8023f970b0f6511a7bb84e72932ca2c')
 
 prepare() {
   cd "${srcdir}/${_pkgsrc}"
@@ -25,12 +27,51 @@
   export CGO_CXXFLAGS="${CXXFLAGS}"
   export CGO_LDFLAGS="${LDFLAGS}"
   export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
+  # Use Arch's compiler; never download a prebuilt toolchain implicitly.
+  export GOTOOLCHAIN=local
   go build -v -o "build/${pkgname}" .
 }
 
 check() {
   cd "${srcdir}/${_pkgsrc}"
+
+  # Fetch test-only module sources while the outbound proxy is still active.
+  # The ordinary build only fetched modules imported by the server binary.
+  export GOTOOLCHAIN=local
+  go mod download
+
+  # Keep loopback requests in the tests and functional probe off outbound proxies.
+  unset http_proxy https_proxy HTTP_PROXY HTTPS_PROXY all_proxy ALL_PROXY
+  export NO_PROXY='127.0.0.1,localhost'
+  export GOTOOLCHAIN=local
+
   go test ./...
+
+  local runtime_dir="${srcdir}/runtime" server_pid
+  rm -rf "${runtime_dir}"
+  install -d "${runtime_dir}/data/sample-bucket" "${runtime_dir}/storage"
+  printf 'source-built emulator\n' > \
+    "${runtime_dir}/data/sample-bucket/proof.txt"
+  "build/${pkgname}" -scheme http -host 127.0.0.1 -port 4443 \
+    -filesystem-root "${runtime_dir}/storage" \
+    -data "${runtime_dir}/data" >"${runtime_dir}/server.log" 2>&1 &
+  server_pid=$!
+  trap 'kill "${server_pid}" 2>/dev/null || true' RETURN
+
+  curl --retry 30 --retry-connrefused --retry-delay 0 -fsS \
+    'http://127.0.0.1:4443/storage/v1/b' >"${runtime_dir}/buckets.json"
+  grep -Fq 'sample-bucket' "${runtime_dir}/buckets.json"
+  curl -fsS 'http://127.0.0.1:4443/storage/v1/b/sample-bucket/o' \
+    >"${runtime_dir}/objects.json"
+  grep -Fq 'proof.txt' "${runtime_dir}/objects.json"
+  curl -fsS \
+    'http://127.0.0.1:4443/download/storage/v1/b/sample-bucket/o/proof.txt?alt=media' \
+    >"${runtime_dir}/proof.txt"
+  grep -Fxq 'source-built emulator' "${runtime_dir}/proof.txt"
+
+  kill "${server_pid}"
+  wait "${server_pid}" || true
+  trap - RETURN
 }
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-20 17:33:19	Medium	1
2026-07-24 00:02:28	Clean	2
2026-07-23 01:22:21	Medium	1
2026-06-18 16:11:54	Clean	0