gup-bin

MEDIUM

maintainer Dominiquini 1 votes scanned 2026-08-23 05:19:50.051162

View on AUR

Why flagged

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

Triggered rules

Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:7 pkgdesc="Update binaries installed by \"go install\" with goroutines"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      2
    
      3_gitauthor=nao1215
    
      4_gitname=gup
    
      5_appname=${_gitname}
    
      6pkgname=${_appname}-bin
    
      7pkgdesc="Update binaries installed by \"go install\" with goroutines"
    
      8
    
      9pkgver=1.8.1
    
      10pkgrel=1
    
      11_gitversion=v${pkgver}
    
      12
    
      13arch=('x86_64' 'i686' 'aarch64')
    
      14_barch=('linux_amd64' 'linux_386' 'linux_arm64')
    
      15
    
      16_ghurl="https://github.com/${_gitauthor}/${_gitname}"
    
      17_ghurlraw="https://raw.githubusercontent.com/${_gitauthor}/${_gitname}/${_gitversion}"
    
      18url=${_ghurl}
    
      19
    
      20license=('Apache-2.0')
    
      21
    
      22provides=("${_appname}")
    
      23conflicts=("${_appname}")
    
      24
    
      25options=('!strip')
    
      26
    
      27_pkgsrc="${_appname}-${pkgver}"
    
      28
    
      29source=("README-${pkgver}.md::${_ghurlraw}/README.md" "LICENSE-${pkgver}::${_ghurlraw}/LICENSE"
    
      30		"${_pkgsrc}-checksums.txt::${_ghurl}/releases/download/${_gitversion}/checksums.txt")
    
      31source_x86_64=("${_pkgsrc}-${arch[0]}.tgz::${_ghurl}/releases/download/${_gitversion}/${_pkgsrc//-/_}_${_barch[0]}.tar.gz")
    
      32source_i686=("${_pkgsrc}-${arch[1]}.tgz::${_ghurl}/releases/download/${_gitversion}/${_pkgsrc//-/_}_${_barch[1]}.tar.gz")
    
      33source_aarch64=("${_pkgsrc}-${arch[2]}.tgz::${_ghurl}/releases/download/${_gitversion}/${_pkgsrc//-/_}_${_barch[2]}.tar.gz")
    
      34sha256sums=('486b8ccca93e8ddc403d072b470decf7f4431b7218bcf7d53ad86c725dd58af0'
    
      35            '9342d2ca1f93313e4f2a06e19db82e4a94462fab17c82eda907226631bd62079'
    
      36            '9445fab309a1747097cacca69c63bc4b3967e8e39b9cd480c5f246544314953d')
    
      37sha256sums_x86_64=('7ee0dbb3c043f7e2d1afd0b44bad2f4fdae647e7245246b9e0ff75524c48b76d')
    
      38sha256sums_i686=('ea3f13e11b471bd15bbdd8e80e6d4d381fde58a03dde9894c92c0975baa8f597')
    
      39sha256sums_aarch64=('562cbf136502ba5b93eb474a1f42d6e1e29b93abc5bd864c2c392e129538591e')
    
      40
    
      41
    
      42verify() {
    
      43	cp "${_pkgsrc}-checksums.txt" "checksums.txt"
    
      44	sed -n \
    
      45		-e "/${_pkgsrc//-/_}_${_barch[0]}.tar.gz/{s//${_pkgsrc}-${arch[0]}.tgz/g;p;}" \
    
      46		-e "/${_pkgsrc//-/_}_${_barch[1]}.tar.gz/{s//${_pkgsrc}-${arch[1]}.tgz/g;p;}" \
    
      47		-e "/${_pkgsrc//-/_}_${_barch[2]}.tar.gz/{s//${_pkgsrc}-${arch[2]}.tgz/g;p;}" \
    
      48		-i "checksums.txt"
    
      49
    
      50	sha256sum -c --ignore-missing "checksums.txt"
    
      51}
    
      52
    
      53package() {
    
      54	cd "${srcdir}/" || exit
    
      55
    
      56	install -Dm755 "${_appname}" "${pkgdir}/usr/bin/${_appname}"
    
      57
    
      58	install -Dm644 "./completions/${_appname}.zsh" "${pkgdir}/usr/share/zsh/site-functions/_${_appname}"
    
      59	install -Dm644 "./completions/${_appname}.bash" "${pkgdir}/usr/share/bash-completion/completions/${_appname}"
    
      60	install -Dm644 "./completions/${_appname}.fish" "${pkgdir}/usr/share/fish/vendor_completions.d/${_appname}.fish"
    
      61
    
      62	install -Dm644 "README-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      63
    
      64	install -Dm644 "LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      65}
    
      66

Changes since previous scan

--- PKGBUILD @ 2026-08-17 00:18
+++ PKGBUILD @ 2026-08-23 05:19
@@ -1,47 +1,45 @@
 # Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
 
-_pkgauthor=nao1215
-_pkgname=gup
-pkgname=${_pkgname}-bin
+_gitauthor=nao1215
+_gitname=gup
+_appname=${_gitname}
+pkgname=${_appname}-bin
+pkgdesc="Update binaries installed by \"go install\" with goroutines"
+
 pkgver=1.8.1
 pkgrel=1
-_pkgvername=v${pkgver}
-pkgdesc="Update binaries installed by \"go install\" with goroutines"
+_gitversion=v${pkgver}
+
 arch=('x86_64' 'i686' 'aarch64')
 _barch=('linux_amd64' 'linux_386' 'linux_arm64')
-url="https://github.com/${_pkgauthor}/${_pkgname}"
-_urlraw="https://raw.githubusercontent.com/${_pkgauthor}/${_pkgname}/${_pkgvername}"
+
+_ghurl="https://github.com/${_gitauthor}/${_gitname}"
+_ghurlraw="https://raw.githubusercontent.com/${_gitauthor}/${_gitname}/${_gitversion}"
+url=${_ghurl}
+
 license=('Apache-2.0')
 
-provides=("${_pkgname}")
-conflicts=("${_pkgname}")
+provides=("${_appname}")
+conflicts=("${_appname}")
 
-options=(!strip)
+options=('!strip')
 
-_pkgsrc="${_pkgname}-${pkgver}"
+_pkgsrc="${_appname}-${pkgver}"
 
-source=("README-${pkgver}.md::${_urlraw}/README.md" "LICENSE-${pkgver}::${_urlraw}/LICENSE"
-		"${_pkgsrc}-checksums.txt::${url}/releases/download/${_pkgvername}/checksums.txt"
-		"${_pkgsrc}-checksums.txt.sigstore.json::${url}/releases/download/${_pkgvername}/checksums.txt.sigstore.json")
-source_x86_64=("${_pkgsrc}-${arch[0]}.tgz::${url}/releases/download/${_pkgvername}/${_pkgsrc//-/_}_${_barch[0]}.tar.gz")
-source_i686=("${_pkgsrc}-${arch[1]}.tgz::${url}/releases/download/${_pkgvername}/${_pkgsrc//-/_}_${_barch[1]}.tar.gz")
-source_aarch64=("${_pkgsrc}-${arch[2]}.tgz::${url}/releases/download/${_pkgvername}/${_pkgsrc//-/_}_${_barch[2]}.tar.gz")
+source=("README-${pkgver}.md::${_ghurlraw}/README.md" "LICENSE-${pkgver}::${_ghurlraw}/LICENSE"
+		"${_pkgsrc}-checksums.txt::${_ghurl}/releases/download/${_gitversion}/checksums.txt")
+source_x86_64=("${_pkgsrc}-${arch[0]}.tgz::${_ghurl}/releases/download/${_gitversion}/${_pkgsrc//-/_}_${_barch[0]}.tar.gz")
+source_i686=("${_pkgsrc}-${arch[1]}.tgz::${_ghurl}/releases/download/${_gitversion}/${_pkgsrc//-/_}_${_barch[1]}.tar.gz")
+source_aarch64=("${_pkgsrc}-${arch[2]}.tgz::${_ghurl}/releases/download/${_gitversion}/${_pkgsrc//-/_}_${_barch[2]}.tar.gz")
 sha256sums=('486b8ccca93e8ddc403d072b470decf7f4431b7218bcf7d53ad86c725dd58af0'
             '9342d2ca1f93313e4f2a06e19db82e4a94462fab17c82eda907226631bd62079'
-            '9445fab309a1747097cacca69c63bc4b3967e8e39b9cd480c5f246544314953d'
-            'ba21b4d509d3c5872bec589600156f25698a47ee441862276220e7bbab2b5fd0')
+            '9445fab309a1747097cacca69c63bc4b3967e8e39b9cd480c5f246544314953d')
 sha256sums_x86_64=('7ee0dbb3c043f7e2d1afd0b44bad2f4fdae647e7245246b9e0ff75524c48b76d')
 sha256sums_i686=('ea3f13e11b471bd15bbdd8e80e6d4d381fde58a03dde9894c92c0975baa8f597')
 sha256sums_aarch64=('562cbf136502ba5b93eb474a1f42d6e1e29b93abc5bd864c2c392e129538591e')
 
 
 verify() {
-	cosign verify-blob \
-		--bundle "${_pkgsrc}-checksums.txt.sigstore.json" \
-		--certificate-identity-regexp "${url}/\.github/workflows/release\.yml@refs/tags/${_pkgvername}" \
-		--certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
-		"${_pkgsrc}-checksums.txt"
-
 	cp "${_pkgsrc}-checksums.txt" "checksums.txt"
 	sed -n \
 		-e "/${_pkgsrc//-/_}_${_barch[0]}.tar.gz/{s//${_pkgsrc}-${arch[0]}.tgz/g;p;}" \
@@ -55,11 +53,11 @@
 package() {
 	cd "${srcdir}/" || exit
 
-	install -Dm755 "${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
+	install -Dm755 "${_appname}" "${pkgdir}/usr/bin/${_appname}"
 
-	install -Dm644 "./completions/${_pkgname}.zsh" "${pkgdir}/usr/share/zsh/site-functions/_${_pkgname}"
-	install -Dm644 "./completions/${_pkgname}.bash" "${pkgdir}/usr/share/bash-completion/completions/${_pkgname}"
-	install -Dm644 "./completions/${_pkgname}.fish" "${pkgdir}/usr/share/fish/vendor_completions.d/${_pkgname}.fish"
+	install -Dm644 "./completions/${_appname}.zsh" "${pkgdir}/usr/share/zsh/site-functions/_${_appname}"
+	install -Dm644 "./completions/${_appname}.bash" "${pkgdir}/usr/share/bash-completion/completions/${_appname}"
+	install -Dm644 "./completions/${_appname}.fish" "${pkgdir}/usr/share/fish/vendor_completions.d/${_appname}.fish"
 
 	install -Dm644 "README-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-23 05:19:50	Medium	1
2026-08-17 00:18:29	Clean	2
2026-08-16 15:32:49	Medium	1
2026-08-14 00:03:41	Clean	2
2026-08-13 05:25:33	Medium	1
2026-07-05 00:27:08	Clean	2
2026-07-04 07:13:52	Medium	1
2026-07-04 00:27:25	Medium	2
2026-07-03 00:17:07	Medium	2
2026-07-02 00:22:12	Medium	2
2026-07-01 00:30:02	Medium	2
2026-06-30 00:15:06	Medium	2
2026-06-29 00:20:06	Medium	2
2026-06-28 00:09:41	Medium	2
2026-06-27 02:27:46	Medium	2
2026-06-24 22:21:07	Clean	2
2026-06-24 06:18:56	Low	2
2026-06-24 02:18:43	Low	2
2026-06-24 00:08:06	Medium	2
2026-06-23 00:13:55	Medium	2