gptsync
maintainer eworm
· 9 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The source is downloading the upstream tarball from a Debian archive host (cloudfront.debian.net) which is a legitimate mirror; the package builds from official Debian source, posing no execution of remote code or supply-chain risk beyond typical AUR packages.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is downloading the upstream tarball from a Debian archive host (cloudfront.debian.net) which is a legitimate mirror; the package builds from official Debian source, posing no execution of remote code or supply-chain risk beyond typical AUR packages.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:13
source=("https://cloudfront.debian.net/debian-archive/debian/pool/main/r/refit/refit_${pkgver}.orig.tar.gz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Christian Hesse <mail@eworm.de>
2
3
pkgname=gptsync
4
pkgver=0.14
5
_pkgrel_debian=2
6
pkgrel=8
7
pkgdesc="gptsync maintains an MBR partition table synchronised with a GPT partition table used as reference."
8
arch=('i686' 'x86_64')
9
depends=('gnu-efi-libs')
10
makedepends=('python2' 'syslinux')
11
url='https://packages.debian.org/wheezy/gptsync'
12
license=('custom')
13
source=("https://cloudfront.debian.net/debian-archive/debian/pool/main/r/refit/refit_${pkgver}.orig.tar.gz"
14
"https://cloudfront.debian.net/debian-archive/debian/pool/main/r/refit/refit_${pkgver}-${_pkgrel_debian}.debian.tar.gz")
15
sha256sums=('0101ac403c3a8c90813df20726c9e76a58515ca7d1a35a7b2ab42eaf28e25e1e'
16
'5418b9d6645453ac53e831c59a255ecfe85a09038e0d5d08fc1a55cf6fb087a3')
17
18
build() {
19
cd ${srcdir}/refit-${pkgver}/
20
21
for PATCH in $(cat ${srcdir}/debian/patches/series); do
22
patch -Np1 < ${srcdir}/debian/patches/${PATCH}
23
done
24
25
cd ${srcdir}/refit-${pkgver}/include/
26
python2 ${srcdir}/debian/mbr/mkmbrhdr.py /usr/lib/syslinux/bios/mbr.bin > syslinux_mbr.h
27
28
cd ${srcdir}/refit-${pkgver}/libeg/
29
make
30
31
cd ${srcdir}/refit-${pkgver}/gptsync/
32
ln -s Makefile.unix Makefile
33
make
34
}
35
36
package() {
37
cd ${srcdir}/refit-${pkgver}/
38
39
install -D -m0755 ${srcdir}/refit-${pkgver}/gptsync/gptsync ${pkgdir}/usr/bin/gptsync
40
install -D -m0755 ${srcdir}/refit-${pkgver}/gptsync/showpart ${pkgdir}/usr/bin/showpart
41
42
install -D -m0644 ${srcdir}/refit-${pkgver}/gptsync/gptsync.8 ${pkgdir}/usr/share/man/man8/gptsync.8
43
install -D -m0644 ${srcdir}/debian/showpart.8 ${pkgdir}/usr/share/man/man8/showpart.8
44
}
45
46
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |