git-annex-standalone

LOW

maintainer orphaned 4 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads prebuilt binaries from the project's official host (kitenet.net), which is not on the whitelist but is the legitimate source for git-annex; the SKIP'd signature is acceptable as PGP verification is performed, and the installed files are limited to expected binaries and data.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from the project's official host (kitenet.net), which is not on the whitelist but is the legitimate source for git-annex; the SKIP'd signature is acceptable as PGP verification is performed, and the installed files are limited to expected binaries and data.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 _info_source_x86_64="https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-amd64.tar.gz.info"

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Thomas Jost <schnouki@schnouki.net>
    
      2# Contributor: Yann Büchau <nobodyinperson at posteo de>
    
      3# Contributor: tee < teeaur at duck dot com >
    
      4pkgname=git-annex-standalone
    
      5pkgver=10.20260420
    
      6pkgrel=1
    
      7pkgdesc="Manage files with git, without checking their contents into git. Standalone version, with no Haskell dependency."
    
      8arch=(x86_64 aarch64)
    
      9url="https://git-annex.branchable.com"
    
      10license=('custom')
    
      11depends=("bzip2" "file" "git" "glibc" "gmp" "libffi" "libyaml" "lsof" "rsync" "sqlite" "zlib")
    
      12depends_aarch64=("libffi7")
    
      13provides=("git-annex")
    
      14conflicts=("git-annex")
    
      15
    
      16# Fetch info about the last release before setting the source URL
    
      17_info_source_x86_64="https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-amd64.tar.gz.info"
    
      18_last_info_x86_64=$(curl -s "${_info_source_x86_64}")
    
      19_last_sha256_x86_64=$(echo "${_last_info_x86_64}" | awk 'NR==3' | cut -d- -f 4 | cut -d. -f1)
    
      20_info_source_aarch64="https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-arm64.tar.gz.info"
    
      21_last_info_aarch64=$(curl -s "${_info_source_aarch64}")
    
      22_last_sha256_aarch64=$(echo "${_last_info_aarch64}" | awk 'NR==3' | cut -d- -f 4 | cut -d. -f1)
    
      23
    
      24_last_pkgver=$(echo "${_last_info_x86_64}" | awk 'NR==4')
    
      25
    
      26source_x86_64=("git-annex-standalone-amd64-${_last_pkgver}.tar.gz::https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-amd64.tar.gz"
    
      27               "git-annex-standalone-amd64-${_last_pkgver}.tar.gz.sig::https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-amd64.tar.gz.sig")
    
      28source_aarch64=("git-annex-standalone-arm64-${_last_pkgver}.tar.gz::https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-arm64.tar.gz"
    
      29               "git-annex-standalone-arm64-${_last_pkgver}.tar.gz.sig::https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-arm64.tar.gz.sig")
    
      30sha256sums_x86_64=("${_last_sha256_x86_64}"
    
      31                   'SKIP')
    
      32sha256sums_aarch64=("${_last_sha256_aarch64}"
    
      33                   'SKIP')
    
      34validpgpkeys=("40055C6AFD2D526B2961E78F5EE1DBA789C809CB")
    
      35
    
      36pkgver() {
    
      37  echo "${_last_pkgver}"
    
      38}
    
      39
    
      40package() {
    
      41  cd "$srcdir/git-annex.linux"
    
      42
    
      43  for exe in git-annex git-annex-shell; do
    
      44    install -Dm755 shimmed/$exe/$exe "$pkgdir/usr/bin/$exe"
    
      45  done
    
      46
    
      47  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      48  install -Dm644 logo.svg "$pkgdir/usr/share/pixmaps/git-annex.svg"
    
      49  install -Dm644 logo_16x16.png "$pkgdir/usr/share/pixmaps/git-annex_16x16.png"
    
      50
    
      51  for f in usr/share/man/man1/*.1; do
    
      52    install -Dm644 $f "$pkgdir/$f"
    
      53  done
    
      54}
    
      55
    
      56# Local Variables:
    
      57# pkgbuild-update-sums-on-save: nil
    
      58# End:
    
      59

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2