forgejo-bin

LOW

maintainer jrpie 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package installs a prebuilt binary from the project's official Codeberg release page, which is a trusted project host; the skipped PGP signature check is a procedural weakness but does not imply active malice, and the binary is from the legitimate upstream.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs a prebuilt binary from the project's official Codeberg release page, which is a trusted project host; the skipped PGP signature check is a procedural weakness but does not imply active malice, and the binary is from the legitimate upstream.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Josia Pietsch <arch@jrpie.de>
    
      2# Contributor: George Rawlinson <grawlinson@archlinux.org>
    
      3
    
      4# Based on extra/forgejo. This is a drop-in replacement using the statically compiled binary provided by forgejo.
    
      5
    
      6_appname=forgejo
    
      7pkgname="${_appname}-bin"
    
      8pkgver=17.0.1
    
      9pkgrel=1
    
      10pkgdesc='A lightweight software forge'
    
      11arch=('x86_64' 'aarch64')
    
      12url='https://forgejo.org'
    
      13license=(GPL-3.0-or-later)
    
      14depends=(
    
      15  git
    
      16)
    
      17optdepends=(
    
      18  'mariadb: MariaDB support'
    
      19  'memcached: MemCached support'
    
      20  'openssh: GIT over SSH support'
    
      21  'pam: Authentication via PAM support'
    
      22  'postgresql: PostgreSQL support'
    
      23  'valkey: Redis support'
    
      24)
    
      25provides=("${_appname}")
    
      26conflicts=("${_appname}")
    
      27backup=(etc/${_appname}/app.ini)
    
      28options=(!debug)
    
      29validpgpkeys=('EB114F5E6C0DC2BCDD183550A4B61A2DC5923710') # Forgejo Releases <release@forgejo.org>; see https://forgejo.org/download/#:~:text=EB114F5E6C0DC2BCDD183550A4B61A2DC5923710
    
      30
    
      31# taken from extra/forgejo
    
      32source=(
    
      33  systemd.service
    
      34  sysusers.conf
    
      35  tmpfiles.conf
    
      36  app.ini # see use-correct-variables.patch in extra/forgejo
    
      37)
    
      38source_x86_64=(
    
      39  "$_appname::https://codeberg.org/forgejo/forgejo/releases/download/v$pkgver/forgejo-$pkgver-linux-amd64"
    
      40  "$_appname.asc::https://codeberg.org/forgejo/forgejo/releases/download/v$pkgver/forgejo-$pkgver-linux-amd64.asc"
    
      41)
    
      42
    
      43source_aarch64=(
    
      44  "$_appname::https://codeberg.org/forgejo/forgejo/releases/download/v$pkgver/forgejo-$pkgver-linux-arm64"
    
      45  "$_appname.asc::https://codeberg.org/forgejo/forgejo/releases/download/v$pkgver/forgejo-$pkgver-linux-arm64.asc"
    
      46)
    
      47
    
      48sha512sums=('a88aefed4aaee9c4d356444a2b3cbad384e07d738da4c87c7298744222ed784c6d5079d74596b8440605da0ad85699ced20106897c345a12994bd1d3ee84da37'
    
      49            '7eb2766c06bb0e104da5860c16fbb9743220b01eec2760a84353b315d0d91a03a10939a105a8b06c6e074782cb76d26e0af8bf8f10881fef6e942dc43300208a'
    
      50            'f18cbfa60912221b29e3b3b824c77571797ac76b90cacd28f2014f295c90c964990d4d5079822d280681fa6b0bb80248cd98d0479a3ac6441a3eaf8179f640a3'
    
      51            'e2882f5b7fb4425ede97e8115a1960c0789a838340526b632c51b98ce6216e520c6fda7eec923bf4bc29966853785767c13370ad2dad24107bb9e78f8669d3f6')
    
      52sha512sums_x86_64=('0150fec25a7c4ce0d3830df8b357c80879e68e925b61a26cd7aae188e6e85116bcfeeaf76111dfee48a2b6eba18759860ac759cbd4469bcc10ecdef8d3df63ed'
    
      53                   'SKIP')
    
      54sha512sums_aarch64=('93b6e18d4f08a1116fd5e463efe5c8fdddfe3261c2589ab69505fb9993a61b34da9ecc9b4b8e8f9bf4eb526363275c7d1b3ba7705989086af9f76a5bdae5c429'
    
      55                    'SKIP')
    
      56
    
      57package() {
    
      58  # systemd integration
    
      59  install -vDm644 systemd.service "$pkgdir/usr/lib/systemd/system/$_appname.service"
    
      60  install -vDm644 sysusers.conf "$pkgdir/usr/lib/sysusers.d/$_appname.conf"
    
      61  install -vDm644 tmpfiles.conf "$pkgdir/usr/lib/tmpfiles.d/$_appname.conf"
    
      62
    
      63  # binary
    
      64  install -vDm755 "$_appname" "$pkgdir/usr/bin/$_appname"
    
      65
    
      66  # configuration
    
      67  install -vdm750 -o root -g "$_appname" "$pkgdir/etc/$_appname"
    
      68  install -vDm660 -o root -g "$_appname" app.ini "$pkgdir/etc/$_appname/app.ini"
    
      69}
    
      70

Changes since previous scan

--- PKGBUILD @ 2026-10-16 00:12
+++ PKGBUILD @ 2026-11-01 00:21
@@ -5,7 +5,7 @@
 
 _appname=forgejo
 pkgname="${_appname}-bin"
-pkgver=17.0.0
+pkgver=17.0.1
 pkgrel=1
 pkgdesc='A lightweight software forge'
 arch=('x86_64' 'aarch64')
@@ -49,9 +49,9 @@
             '7eb2766c06bb0e104da5860c16fbb9743220b01eec2760a84353b315d0d91a03a10939a105a8b06c6e074782cb76d26e0af8bf8f10881fef6e942dc43300208a'
             'f18cbfa60912221b29e3b3b824c77571797ac76b90cacd28f2014f295c90c964990d4d5079822d280681fa6b0bb80248cd98d0479a3ac6441a3eaf8179f640a3'
             'e2882f5b7fb4425ede97e8115a1960c0789a838340526b632c51b98ce6216e520c6fda7eec923bf4bc29966853785767c13370ad2dad24107bb9e78f8669d3f6')
-sha512sums_x86_64=('76115bd2dcc11f7c1d9d96ed73312eb1b9ff64b070c3198d2b4d01f88f847b530e19df4099db0f196e24d5b0cedf225df42ee1f55b71f11902b807052bb9be11'
+sha512sums_x86_64=('0150fec25a7c4ce0d3830df8b357c80879e68e925b61a26cd7aae188e6e85116bcfeeaf76111dfee48a2b6eba18759860ac759cbd4469bcc10ecdef8d3df63ed'
                    'SKIP')
-sha512sums_aarch64=('8d4697b4912e7124e4e92e0b31e8f89a812b580dff99930f6cfa0bf06ccc775f3da3c5867427cf3948590095a6372503b7d9cb0519f2aee7ddc01f59d9066f4e'
+sha512sums_aarch64=('93b6e18d4f08a1116fd5e463efe5c8fdddfe3261c2589ab69505fb9993a61b34da9ecc9b4b8e8f9bf4eb526363275c7d1b3ba7705989086af9f76a5bdae5c429'
                     'SKIP')
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 19:45:59	Medium	1
2026-10-16 00:12:47	Clean	3
2026-10-15 21:13:25	Medium	2
2026-10-15 00:28:05	Low	3
2026-10-14 00:06:47	Low	3
2026-10-13 00:23:45	Low	3
2026-10-12 15:13:59	Medium	2
2026-10-12 00:18:51	Low	3
2026-10-11 00:26:05	Low	3
2026-10-10 00:11:52	Low	3
2026-10-09 00:05:33	Low	3
2026-10-08 00:28:03	Low	3
2026-10-07 00:21:34	Low	3
2026-10-06 00:13:36	Low	3