ftr-site-config-git

maintainer kseistrup · 3 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The package installs site-config text files from a legitimate project Git repository and a CC0 license; no executable code is involved, so even if the host were compromised, the worst case is data tampering, not code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs site-config text files from a legitimate project Git repository and a CC0 license; no executable code is involved, so even if the host were compromised, the worst case is data tampering, not code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:18 'CC0-1.0.txt::https://creativecommons.org/publicdomain/zero/1.0/legalcode.txt'

PKGBUILD

1 offending line(s) highlighted
1# -*- sh -*-
2
3# Maintainer: Klaus Alexander Seistrup <$(echo 0x1fd+d59decfa=40 | tr 0-9+a-f=x ka-i@p-u.l)>
4
5pkgname='ftr-site-config-git'
6_pkgname="${pkgname/-git/}"
7pkgver=2025.12.1.r3746.g44ec894
8pkgrel=1
9pkgdesc='Full-Text RSS: Site-specific article extraction rules (development version)'
10arch=('any')
11url='https://github.com/fivefilters/ftr-site-config'
12license=('CC0-1.0') # SPDX-License-Identifier: CC0-1.0
13makedepends=('findutils' 'git')
14depends=()
15optdepends=()
16source=(
17 "$_pkgname::git+$url.git"
18 'CC0-1.0.txt::https://creativecommons.org/publicdomain/zero/1.0/legalcode.txt'
19)
20provides=("$_pkgname")
21conflicts=("${provides[@]}")
22sha256sums=('SKIP' 'SKIP')
23options=('!strip')
24
25pkgver() {
26 cd "$_pkgname"
27
28 ( set -o pipefail
29 git describe --long --abbrev=7 2>/dev/null | sed 's/\([^-]*-g\)/r\1/;s/-/./g' \
30 || {
31 _today=''; _today=$(printf '%(%Y.%-m.%-d)T')
32 printf '%s.r%s.g%s' "$_today" \
33 "$(git rev-list --count HEAD)" \
34 "$(git rev-parse --short=7 HEAD)"
35 }
36 )
37}
38
39prepare() {
40 cd "$_pkgname"
41
42 git clean -dfx
43}
44
45build() {
46 cd "$_pkgname"
47
48 : pass
49}
50
51package() {
52 cd "$_pkgname"
53
54 install -Dm0644 -t "$pkgdir/usr/share/licenses/$pkgname" "$srcdir/CC0-1.0.txt"
55 install -Dm0644 -t "$pkgdir/usr/share/licenses/$pkgname" LICENSE.txt
56 install -Dm0644 -t "$pkgdir/usr/share/doc/$pkgname" README.md
57
58 find . -maxdepth 1 -type f -name '\.*.txt' -print0 \
59 | xargs -r0 install -Dm0644 -t "$pkgdir/usr/share/$_pkgname"
60
61 find . -maxdepth 1 -type f -name '*.txt' -print0 \
62 | xargs -r0 install -Dm0644 -t "$pkgdir/usr/share/$_pkgname"
63
64 rm -f "$pkgdir/usr/share/$_pkgname/LICENSE.txt"
65
66 for _dir in doc licenses; do
67 cd "$pkgdir/usr/share/$_dir" && ln -sr "$pkgname" "$_pkgname"
68 done
69}
70
71# eof
72

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2
2026-07-15 00:09:25 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion