forgejo-bin

LOW

maintainer orphaned 0 votes scanned 2026-09-17 17:25:53.299830

View on AUR

Why flagged

The package downloads a prebuilt binary from a Codeberg attachment URL, which is an official project host but not a standard release URL pattern; however, the binary is from the project's own forge, reducing supply-chain risk, and the checksums are provided and verifiable, making it low risk despite the unusual source URL.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 90%): The package downloads a prebuilt binary from a Codeberg attachment URL, which is an official project host but not a standard release URL pattern; however, the binary is from the project's own forge, reducing supply-chain risk, and the checksums are provided and verifiable, making it low risk despite the unusual source URL.

PKGBUILD

      1# Maintainer: Reid McKenzie <me@arrdem.com>
    
      2
    
      3pkgname=forgejo-bin
    
      4pkgver=1.18.0
    
      5pkgrel=1
    
      6pkgdesc='A lightweight software forge'
    
      7arch=('x86_64')
    
      8url='https://forgejo.org'
    
      9license=('MIT')
    
      10depends=('git')
    
      11conflicts=(
    
      12  'forgejo'
    
      13  'forgejo-git'
    
      14)
    
      15optdepends=(
    
      16  'mariadb: MariaDB support'
    
      17  'memcached: MemCached support'
    
      18  'openssh: GIT over SSH support'
    
      19  'pam: Authentication via PAM support'
    
      20  'postgresql: PostgreSQL support'
    
      21  'redis: Redis support'
    
      22  'sqlite: SQLite support'
    
      23)
    
      24backup=('etc/forgejo/app.ini')
    
      25_commit="88445b62374e8165d44d5520de736a7b7c98fd1b"
    
      26source=(
    
      27  # FIXME: No clear way to reference specific release binaries by logical filename on codeberg?
    
      28  # Per https://codeberg.org/forgejo/forgejo/releases/tag/v1.18.0-1, this is amd64
    
      29  "forgeo-${pkgver}::https://codeberg.org/attachments/a26d3acd-5c2e-4132-a283-8110da2872d4"
    
      30  "app.example.ini::https://codeberg.org/forgejo/forgejo/raw/commit/${_commit}/custom/conf/app.example.ini"
    
      31  "LICENSE::https://codeberg.org/forgejo/forgejo/raw/commit/${_commit}/LICENSE"
    
      32  'systemd.service'
    
      33  'sysusers.conf'
    
      34  'tmpfiles.conf'
    
      35)
    
      36sha256sums=('109577e82dd06a57b47b54999c711f58d636af6dad5da90f6f39b0a13c1a2253'
    
      37            '7b5b56a6403ffcf1c962ac76288de4bc52852e2e74f06068fdd55d21e327869a'
    
      38            'ed2f10a9d78b8c6c9ef33f1420d0eb266981891caf2f15d630553f02dc60d3ae'
    
      39            '55890bb0f98ea76f92db83daf77f8cbe6f01c9d3f1eb013e2a3a5fc48e74b09d'
    
      40            '563ebe7e826c351786612102a303b9b3726a218e471b89817af94b2326f46a83'
    
      41            'f0f34da0f12606fa44ee3a03839b12c9f77576fd6d63659a0aaf5b336643555f')
    
      42
    
      43package() {
    
      44  # systemd integration
    
      45  install -vDm644 systemd.service "$pkgdir/usr/lib/systemd/system/$pkgname.service"
    
      46  install -vDm644 sysusers.conf "$pkgdir/usr/lib/sysusers.d/$pkgname.conf"
    
      47  install -vDm644 tmpfiles.conf "$pkgdir/usr/lib/tmpfiles.d/$pkgname.conf"
    
      48  install -vDm644 app.example.ini -t "$pkgdir/etc/$pkgname"
    
      49
    
      50  # binary
    
      51  install -vDm755 "forgeo-${pkgver}" "$pkgdir/usr/bin/$pkgname"
    
      52
    
      53  # license
    
      54  install -vDm644 -t "$pkgdir/usr/share/licenses/$pkgname" LICENSE
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 17:25:53	Low	2