git-annex-standalone

MEDIUM

maintainer tee 4 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads prebuilt standalone binaries from a non-whitelisted but project-associated host (downloads.kitenet.net), which is a supply-chain risk if the source were swapped; checksums are partially skipped, increasing risk, but the binaries are from the official git-annex infrastructure, mitigating severity.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 _info_source_x86_64="https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-amd64.tar.gz.info"

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt standalone binaries from a non-whitelisted but project-associated host (downloads.kitenet.net), which is a supply-chain risk if the source were swapped; checksums are partially skipped, increasing risk, but the binaries are from the official git-annex infrastructure, mitigating severity.

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Thomas Jost <schnouki@schnouki.net>
    
      2# Contributor: Yann Büchau <nobodyinperson at posteo de>
    
      3# Contributor: tee < teeaur at duck dot com >
    
      4pkgname=git-annex-standalone
    
      5pkgver=10.20261006
    
      6pkgrel=1
    
      7pkgdesc="Manage files with git, without checking their contents into git. Standalone version, with no Haskell dependency."
    
      8arch=(x86_64 aarch64)
    
      9url="https://git-annex.branchable.com"
    
      10license=('custom')
    
      11depends=("botan" "bzip2" "file" "git" "glibc" "gmp" "libffi" "libyaml" "lsof" "rsync" "sqlite" "zlib")
    
      12depends_aarch64=("libffi7")
    
      13provides=("git-annex")
    
      14conflicts=("git-annex")
    
      15
    
      16# Fetch info about the last release before setting the source URL
    
      17_info_source_x86_64="https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-amd64.tar.gz.info"
    
      18_last_info_x86_64=$(curl -s "${_info_source_x86_64}")
    
      19_last_sha256_x86_64=$(echo "${_last_info_x86_64}" | awk 'NR==3' | cut -d- -f 4 | cut -d. -f1)
    
      20_info_source_aarch64="https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-arm64.tar.gz.info"
    
      21_last_info_aarch64=$(curl -s "${_info_source_aarch64}")
    
      22_last_sha256_aarch64=$(echo "${_last_info_aarch64}" | awk 'NR==3' | cut -d- -f 4 | cut -d. -f1)
    
      23
    
      24_last_pkgver=$(echo "${_last_info_x86_64}" | awk 'NR==4')
    
      25
    
      26source_x86_64=("git-annex-standalone-amd64-${_last_pkgver}.tar.gz::https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-amd64.tar.gz"
    
      27               "git-annex-standalone-amd64-${_last_pkgver}.tar.gz.sig::https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-amd64.tar.gz.sig")
    
      28source_aarch64=("git-annex-standalone-arm64-${_last_pkgver}.tar.gz::https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-arm64.tar.gz"
    
      29               "git-annex-standalone-arm64-${_last_pkgver}.tar.gz.sig::https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-arm64.tar.gz.sig")
    
      30sha256sums_x86_64=("${_last_sha256_x86_64}"
    
      31                   'SKIP')
    
      32sha256sums_aarch64=("${_last_sha256_aarch64}"
    
      33                    'SKIP')
    
      34validpgpkeys=("40055C6AFD2D526B2961E78F5EE1DBA789C809CB")
    
      35
    
      36pkgver() {
    
      37  echo "${_last_pkgver}"
    
      38}
    
      39
    
      40package() {
    
      41  cd "git-annex.linux"
    
      42
    
      43  for exe in git-annex git-annex-shell; do
    
      44    install -Dm755 shimmed/$exe/$exe "$pkgdir/usr/bin/$exe"
    
      45  done
    
      46
    
      47  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      48  install -Dm644 logo.svg "$pkgdir/usr/share/pixmaps/git-annex.svg"
    
      49  install -Dm644 logo_16x16.png "$pkgdir/usr/share/pixmaps/git-annex_16x16.png"
    
      50
    
      51  for f in usr/share/man/man1/*.1; do
    
      52    install -Dm644 $f "$pkgdir/$f"
    
      53  done
    
      54}
    
      55
    
      56# Local Variables:
    
      57# pkgbuild-update-sums-on-save: nil
    
      58# End:
    
      59

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	3
2026-10-31 00:07:41	Medium	3
2026-10-30 00:29:30	Medium	3
2026-10-29 00:13:55	Medium	3
2026-10-28 00:06:54	Medium	3
2026-10-27 00:23:28	Medium	3
2026-10-26 00:12:40	Medium	3
2026-10-25 00:20:48	Medium	3
2026-10-24 00:14:55	Medium	3
2026-10-23 00:02:19	Medium	3
2026-10-22 00:13:10	Medium	3
2026-10-21 00:12:50	Medium	3
2026-10-20 00:10:31	Medium	3
2026-10-19 00:03:55	Medium	3
2026-10-18 00:06:55	Medium	3
2026-10-17 00:21:55	Medium	3
2026-10-16 00:12:47	Medium	3
2026-10-15 00:28:05	Medium	3
2026-10-14 00:06:47	Medium	3
2026-10-13 00:23:45	Medium	3