frankenphp

LOW

maintainer flyin1501 0 votes scanned 2026-10-27 00:23:28.674093

View on AUR

Why flagged

Package builds from official project source on GitHub, which is normal for AUR packages; the orphaned/re-adopted status is administrative and does not imply malicious intent or supply-chain risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): Package builds from official project source on GitHub, which is normal for AUR packages; the orphaned/re-adopted status is administrative and does not imply malicious intent or supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: David Lumaye <david at chindit dot be>
    
      2
    
      3pkgname=frankenphp
    
      4pkgver=1.2.0
    
      5pkgrel=1
    
      6pkgdesc="FrankenPHP: Modern app server for PHP"
    
      7arch=('x86_64')
    
      8url="https://github.com/dunglas/frankenphp"
    
      9license=('MIT')
    
      10depends=()
    
      11makedepends=('php-embed' 'go')
    
      12source=("$pkgname-$pkgver.tar.gz::https://github.com/dunglas/frankenphp/archive/refs/tags/v$pkgver/frankenphp.tar.gz")
    
      13sha256sums=('f862a89b56fa96fc63adb80896579f609965516850504c26d695943925647853')
    
      14
    
      15build() {
    
      16  cd "$srcdir"
    
      17  tar xzvf "$pkgname-$pkgver.tar.gz"
    
      18  cd "frankenphp-$pkgver/caddy/frankenphp/"
    
      19  CGO_CFLAGS=$(php-config --includes) CGO_LDFLAGS="$(php-config --ldflags) $(php-config --libs)" go build
    
      20}
    
      21
    
      22package() {
    
      23  cd "$srcdir"
    
      24  install -Dm755 "frankenphp-$pkgver/caddy/frankenphp/frankenphp" "$pkgdir/usr/bin/frankenphp"
    
      25}
    
      26

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-27 00:23:28	Low	2
2026-10-26 21:45:59	Medium	1
2026-06-18 16:11:54	Clean	0