govulncheck-git

maintainer prochac · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a Git repository from the official Go project's infrastructure (googlesource.com), which is a legitimate and trusted host for Go projects, despite not being on the analyzer's whitelist; the package builds from source, which is normal for AUR, and installs only the resulting binary and license.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a Git repository from the official Go project's infrastructure (googlesource.com), which is a legitimate and trusted host for Go projects, despite not being on the analyzer's whitelist; the package builds from source, which is normal for AUR, and installs only the resulting binary and license.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("git+https://go.googlesource.com/${_gitname}")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: prochac <tomas.prochazka5d[at]gmail[dot]com>
    
      2# Contributor: kpcyrd <kpcyrd[at]archlinux[dot]org>
    
      3
    
      4_gitname=vuln
    
      5pkgname=govulncheck-git
    
      6pkgver=1.6.0.r0.g19b0bb6a2
    
      7pkgrel=1
    
      8pkgdesc='Database client and tools for the Go vulnerability database (git version)'
    
      9url='https://go.googlesource.com/vuln/'
    
      10arch=('x86_64')
    
      11license=('BSD-3-Clause')
    
      12depends=('glibc')
    
      13makedepends=('go' 'git')
    
      14provides=("govulncheck=${pkgver}")
    
      15conflicts=('govulncheck')
    
      16source=("git+https://go.googlesource.com/${_gitname}")
    
      17b2sums=('SKIP')
    
      18
    
      19pkgver() {
    
      20  cd "${_gitname}"
    
      21  git describe --tags --long | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      22}
    
      23
    
      24prepare() {
    
      25  cd "${_gitname}"
    
      26  go mod download
    
      27}
    
      28
    
      29build() {
    
      30  cd "${_gitname}"
    
      31  export CGO_CPPFLAGS="${CPPFLAGS}"
    
      32  export CGO_CFLAGS="${CFLAGS}"
    
      33  export CGO_CXXFLAGS="${CXXFLAGS}"
    
      34  export CGO_LDFLAGS="${LDFLAGS}"
    
      35  export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
    
      36  # Build outside the worktree: an untracked binary in it would make the
    
      37  # VCS stamp report +dirty and would also perturb pkgver() on rebuilds.
    
      38  go build -o "${srcdir}/govulncheck" ./cmd/govulncheck
    
      39}
    
      40
    
      41package() {
    
      42  cd "${_gitname}"
    
      43  install -Dm 755 "${srcdir}/govulncheck" -t "${pkgdir}/usr/bin"
    
      44  install -Dm 644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      45}
    
      46
    
      47# vim:set ts=2 sw=2 et:
    
      48

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -3,37 +3,44 @@
 
 _gitname=vuln
 pkgname=govulncheck-git
-pkgver=1.1.3
-pkgrel=3
-pkgdesc='Database client and tools for the Go vulnerability database'
+pkgver=1.6.0.r0.g19b0bb6a2
+pkgrel=1
+pkgdesc='Database client and tools for the Go vulnerability database (git version)'
 url='https://go.googlesource.com/vuln/'
 arch=('x86_64')
 license=('BSD-3-Clause')
+depends=('glibc')
 makedepends=('go' 'git')
-provides=('govulncheck')
+provides=("govulncheck=${pkgver}")
 conflicts=('govulncheck')
-source=(git+http://go.googlesource.com/${_gitname}/)
+source=("git+https://go.googlesource.com/${_gitname}")
 b2sums=('SKIP')
 
 pkgver() {
-  cd ${_gitname}
-  echo ${pkgver}
+  cd "${_gitname}"
+  git describe --tags --long | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
 }
 
 prepare() {
-  cd "${srcdir}/${_gitname}"
-  # Checkout the specific tag
-  git checkout "v${pkgver}"
+  cd "${_gitname}"
+  go mod download
 }
 
 build() {
-  cd ${_gitname}
-  go build -o govulncheck ./cmd/govulncheck
+  cd "${_gitname}"
+  export CGO_CPPFLAGS="${CPPFLAGS}"
+  export CGO_CFLAGS="${CFLAGS}"
+  export CGO_CXXFLAGS="${CXXFLAGS}"
+  export CGO_LDFLAGS="${LDFLAGS}"
+  export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
+  # Build outside the worktree: an untracked binary in it would make the
+  # VCS stamp report +dirty and would also perturb pkgver() on rebuilds.
+  go build -o "${srcdir}/govulncheck" ./cmd/govulncheck
 }
 
 package() {
-  cd ${_gitname}
-  install -Dm 755 govulncheck -t "${pkgdir}/usr/bin"
+  cd "${_gitname}"
+  install -Dm 755 "${srcdir}/govulncheck" -t "${pkgdir}/usr/bin"
   install -Dm 644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 13:11:48	MEDIUM	1
2026-06-19 19:07:35	CLEAN	2
2026-06-18 16:11:54	MEDIUM	1