git-annex-standalone

maintainer rasmusgustavsson · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt binaries from the project's official host (kitenet.net), which is not on the whitelist but is the legitimate source for git-annex; the SKIP'd signature is acceptable as PGP verification is performed, and the installed files are limited to expected binaries and data.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from the project's official host (kitenet.net), which is not on the whitelist but is the legitimate source for git-annex; the SKIP'd signature is acceptable as PGP verification is performed, and the installed files are limited to expected binaries and data.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 _info_source_x86_64="https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-amd64.tar.gz.info"

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Thomas Jost <schnouki@schnouki.net>
    
      2# Contributor: Yann Büchau <nobodyinperson at posteo de>
    
      3# Contributor: tee < teeaur at duck dot com >
    
      4pkgname=git-annex-standalone
    
      5pkgver=10.20260420
    
      6pkgrel=1
    
      7pkgdesc="Manage files with git, without checking their contents into git. Standalone version, with no Haskell dependency."
    
      8arch=(x86_64 aarch64)
    
      9url="https://git-annex.branchable.com"
    
      10license=('custom')
    
      11depends=("bzip2" "file" "git" "glibc" "gmp" "libffi" "libyaml" "lsof" "rsync" "sqlite" "zlib")
    
      12depends_aarch64=("libffi7")
    
      13provides=("git-annex")
    
      14conflicts=("git-annex")
    
      15
    
      16# Fetch info about the last release before setting the source URL
    
      17_info_source_x86_64="https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-amd64.tar.gz.info"
    
      18_last_info_x86_64=$(curl -s "${_info_source_x86_64}")
    
      19_last_sha256_x86_64=$(echo "${_last_info_x86_64}" | awk 'NR==3' | cut -d- -f 4 | cut -d. -f1)
    
      20_info_source_aarch64="https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-arm64.tar.gz.info"
    
      21_last_info_aarch64=$(curl -s "${_info_source_aarch64}")
    
      22_last_sha256_aarch64=$(echo "${_last_info_aarch64}" | awk 'NR==3' | cut -d- -f 4 | cut -d. -f1)
    
      23
    
      24_last_pkgver=$(echo "${_last_info_x86_64}" | awk 'NR==4')
    
      25
    
      26source_x86_64=("git-annex-standalone-amd64-${_last_pkgver}.tar.gz::https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-amd64.tar.gz"
    
      27               "git-annex-standalone-amd64-${_last_pkgver}.tar.gz.sig::https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-amd64.tar.gz.sig")
    
      28source_aarch64=("git-annex-standalone-arm64-${_last_pkgver}.tar.gz::https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-arm64.tar.gz"
    
      29               "git-annex-standalone-arm64-${_last_pkgver}.tar.gz.sig::https://downloads.kitenet.net/git-annex/linux/current/git-annex-standalone-arm64.tar.gz.sig")
    
      30sha256sums_x86_64=("${_last_sha256_x86_64}"
    
      31                   'SKIP')
    
      32sha256sums_aarch64=("${_last_sha256_aarch64}"
    
      33                   'SKIP')
    
      34validpgpkeys=("40055C6AFD2D526B2961E78F5EE1DBA789C809CB")
    
      35
    
      36pkgver() {
    
      37  echo "${_last_pkgver}"
    
      38}
    
      39
    
      40package() {
    
      41  cd "$srcdir/git-annex.linux"
    
      42
    
      43  for exe in git-annex git-annex-shell; do
    
      44    install -Dm755 shimmed/$exe/$exe "$pkgdir/usr/bin/$exe"
    
      45  done
    
      46
    
      47  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      48  install -Dm644 logo.svg "$pkgdir/usr/share/pixmaps/git-annex.svg"
    
      49  install -Dm644 logo_16x16.png "$pkgdir/usr/share/pixmaps/git-annex_16x16.png"
    
      50
    
      51  for f in usr/share/man/man1/*.1; do
    
      52    install -Dm644 $f "$pkgdir/$f"
    
      53  done
    
      54}
    
      55
    
      56# Local Variables:
    
      57# pkgbuild-update-sums-on-save: nil
    
      58# End:
    
      59

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2