hibp

maintainer bbx0 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The gem install is for a build dependency (Mxx_ru) used in the prepare phase, runs locally from the project's own source, and does not execute untrusted remote code or install packages from ambiguous sources.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The gem install is for a build dependency (Mxx_ru) used in the prepare phase, runs locally from the project's own source, and does not execute untrusted remote code or install packages from ambiguous sources.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:23 gem install --no-user-install Mxx_ru

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Philipp Micheel <bbx0+aur at bitdevs dot de>
    
      2# Contributor: Oliver Schönrock <oliver at schonrocks dot com>
    
      3
    
      4# shellcheck shell=bash disable=SC2034,SC2154,SC2164
    
      5
    
      6pkgname=hibp
    
      7pkgver=0.6.2
    
      8pkgrel=1
    
      9pkgdesc="Have I been pwned: High performance downloader, query tool, server and utilities"
    
      10arch=('x86_64' 'aarch64')
    
      11url="https://github.com/oschonrock/${pkgname}"
    
      12license=('Apache-2.0')
    
      13depends=('curl' 'gcc-libs' 'glibc' 'libevent' 'onetbb')
    
      14makedepends=('cmake' 'git' 'ninja' 'ruby' 'ruby-rake' 'wget' 'unzip')
    
      15source=("git+${url}.git#tag=v${pkgver}")
    
      16b2sums=('3472e85d3092e992cdf9cf2ee96ce4165828f9574f80c49abdeb1e2c23796e4c2e50cc4330725dcde3274ae8b060c837954cb8ae5d3e9c1e3dde620d58a59bbb')
    
      17
    
      18prepare() {
    
      19	cd "${srcdir}/${pkgname}"
    
      20	git submodule update --init --recursive
    
      21
    
      22	export GEM_HOME="${srcdir}/${pkgname}/.gem"
    
      23	gem install --no-user-install Mxx_ru
    
      24
    
      25	cd "${srcdir}/${pkgname}/ext/restinio"
    
      26	"${GEM_HOME}/bin/mxxruexternals"
    
      27}
    
      28
    
      29build() {
    
      30	cmake \
    
      31		-G Ninja \
    
      32		-B build \
    
      33		-S "${pkgname}" \
    
      34		-W no-dev \
    
      35		-D CMAKE_BUILD_TYPE=release \
    
      36		-D BINFUSE_TEST=OFF \
    
      37		-D HIBP_TEST=ON \
    
      38		-D HIBP_WITH_PSTL=ON \
    
      39		-D NOPCH=ON \
    
      40		--install-prefix=/usr
    
      41	cmake --build build
    
      42}
    
      43
    
      44package() {
    
      45	DESTDIR="${pkgdir}" cmake --install build
    
      46
    
      47	# Clean-up leftover header and cmake files
    
      48	find "${pkgdir}" -type f \( -name '*.cmake' -or -name '*.h' -or -name '*.hpp' -or -name '*.ipp' \) -delete
    
      49	find "${pkgdir}" -type d -empty -delete
    
      50
    
      51	cd "${pkgname}"
    
      52	install -Dm0644 -t "${pkgdir}/usr/share/doc/${pkgname}/" README.md
    
      53	install -Dm0644 -t "${pkgdir}/usr/share/licenses/${pkgname}/" LICENSE
    
      54}
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2