ibmcloud-cli

LOW

maintainer connesc 11 votes scanned 2026-09-29 00:07:46.805866

View on AUR

Why flagged

The package downloads prebuilt IBM Cloud CLI binaries from an official IBM domain (cloud.ibm.com), which is the project's legitimate source; despite the static analyzer flag for a non-standard host, the download is verifiable via sha256sums and poses no active supply-chain risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt IBM Cloud CLI binaries from an official IBM domain (cloud.ibm.com), which is the project's legitimate source; despite the static analyzer flag for a non-standard host, the download is verifiable via sha256sums and poses no active supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source_x86_64=("https://download.clis.cloud.ibm.com/ibm-cloud-cli/${pkgver}/binaries/IBM_Cloud_CLI_${pkgver}_linux_amd64.tgz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Cédric Connes <cedric.connes@gmail.com>
    
      2pkgname=ibmcloud-cli
    
      3pkgver=2.47.1
    
      4pkgrel=1
    
      5pkgdesc="Command line client for IBM Cloud"
    
      6arch=('x86_64' 'i686' 'aarch64')
    
      7url="https://console.bluemix.net/docs/cli/reference/ibmcloud/all_versions.html"
    
      8license=('CUSTOM')
    
      9depends=()
    
      10provides=('bluemix-cli')
    
      11conflicts=('bluemix-cli')
    
      12replaces=('bluemix-cli')
    
      13source_x86_64=("https://download.clis.cloud.ibm.com/ibm-cloud-cli/${pkgver}/binaries/IBM_Cloud_CLI_${pkgver}_linux_amd64.tgz")
    
      14source_i686=("https://download.clis.cloud.ibm.com/ibm-cloud-cli/${pkgver}/binaries/IBM_Cloud_CLI_${pkgver}_linux_386.tgz")
    
      15source_aarch64=("https://download.clis.cloud.ibm.com/ibm-cloud-cli/${pkgver}/binaries/IBM_Cloud_CLI_${pkgver}_linux_arm64.tgz")
    
      16sha256sums_x86_64=('2455a5ef84dbf59e03c1cf170e77423ce1ec56606fe28d633fc31fff1c60a5d6')
    
      17sha256sums_i686=('c0209927d348f11e48610b8fc676971e5092c08332ea43df2b7d734778d7949f')
    
      18sha256sums_aarch64=('2820f61605da81ba98f81758a18d99d6dac8731767065cccb2b8bef1ef9a7c5b')
    
      19
    
      20package() {
    
      21  cd "${srcdir}/IBM_Cloud_CLI/"
    
      22
    
      23  mkdir -p "${pkgdir}/opt/ibmcloud/"
    
      24  install -D "NOTICE" "${pkgdir}/opt/ibmcloud/bin/NOTICE"
    
      25  install -D "LICENSE" "${pkgdir}/opt/ibmcloud/bin/LICENSE"
    
      26  install -D "ibmcloud" "${pkgdir}/opt/ibmcloud/bin/ibmcloud"
    
      27  install -D "autocomplete/bash_autocomplete" "${pkgdir}/opt/ibmcloud/autocomplete/bash_autocomplete"
    
      28  install -D "autocomplete/zsh_autocomplete" "${pkgdir}/opt/ibmcloud/autocomplete/zsh_autocomplete"
    
      29
    
      30  install -d "${pkgdir}/usr/bin"
    
      31
    
      32  ln -sf /opt/ibmcloud/bin/ibmcloud "${pkgdir}/opt/ibmcloud/bin/bluemix"
    
      33  ln -sf /opt/ibmcloud/bin/ibmcloud "${pkgdir}/opt/ibmcloud/bin/bx"
    
      34  ln -sf /opt/ibmcloud/bin/ibmcloud "${pkgdir}/usr/bin/bluemix"
    
      35  ln -sf /opt/ibmcloud/bin/ibmcloud "${pkgdir}/usr/bin/bx"
    
      36  ln -sf /opt/ibmcloud/bin/ibmcloud "${pkgdir}/usr/bin/ibmcloud"
    
      37
    
      38  install -d "${pkgdir}/usr/share/bash-completion/completions"
    
      39
    
      40  ln -sf /opt/ibmcloud/autocomplete/bash_autocomplete "${pkgdir}/usr/share/bash-completion/completions/ibmcloud"
    
      41
    
      42  chown -R root:root "${pkgdir}/opt/ibmcloud/"
    
      43  chmod -R 755 "${pkgdir}/opt/ibmcloud/"
    
      44
    
      45  install -Dm644 "LICENSE" "${pkgdir}/usr/share/licenses/$pkgname/LICENSE"
    
      46}
    
      47

Changes since previous scan

--- PKGBUILD @ 2026-08-29 00:29
+++ PKGBUILD @ 2026-09-29 00:07
@@ -1,6 +1,6 @@
 # Maintainer: Cédric Connes <cedric.connes@gmail.com>
 pkgname=ibmcloud-cli
-pkgver=2.47.0
+pkgver=2.47.1
 pkgrel=1
 pkgdesc="Command line client for IBM Cloud"
 arch=('x86_64' 'i686' 'aarch64')
@@ -13,9 +13,9 @@
 source_x86_64=("https://download.clis.cloud.ibm.com/ibm-cloud-cli/${pkgver}/binaries/IBM_Cloud_CLI_${pkgver}_linux_amd64.tgz")
 source_i686=("https://download.clis.cloud.ibm.com/ibm-cloud-cli/${pkgver}/binaries/IBM_Cloud_CLI_${pkgver}_linux_386.tgz")
 source_aarch64=("https://download.clis.cloud.ibm.com/ibm-cloud-cli/${pkgver}/binaries/IBM_Cloud_CLI_${pkgver}_linux_arm64.tgz")
-sha256sums_x86_64=('55af570961b8865b4261828be5dd324be02ef838ba34ed6d87a5555d9eade99c')
-sha256sums_i686=('48cc1a43aeb79a9903e95b9a06162d14fd1e826371f6c6de67b0dbcccc748276')
-sha256sums_aarch64=('196bb78718cac63c077b1bc1e817336df387bc04f515476c4f0df80d1988bd61')
+sha256sums_x86_64=('2455a5ef84dbf59e03c1cf170e77423ce1ec56606fe28d633fc31fff1c60a5d6')
+sha256sums_i686=('c0209927d348f11e48610b8fc676971e5092c08332ea43df2b7d734778d7949f')
+sha256sums_aarch64=('2820f61605da81ba98f81758a18d99d6dac8731767065cccb2b8bef1ef9a7c5b')
 
 package() {
   cd "${srcdir}/IBM_Cloud_CLI/"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-29 00:07:46	Low	2
2026-09-28 23:22:18	Medium	1
2026-08-29 00:29:17	Clean	2
2026-08-28 21:36:41	Medium	1
2026-08-28 00:07:31	Low	2
2026-08-27 00:08:17	Low	2
2026-08-26 00:12:07	Low	2
2026-08-25 00:14:31	Low	2
2026-08-24 00:17:16	Low	2
2026-08-23 00:10:13	Low	2
2026-08-22 00:02:17	Low	2
2026-08-21 00:01:35	Low	2
2026-08-20 00:05:13	Low	2
2026-08-19 00:15:45	Low	2
2026-08-18 00:03:42	Low	2
2026-08-17 00:18:29	Low	2
2026-08-16 00:03:42	Low	2
2026-08-15 00:26:13	Low	2
2026-08-14 00:03:41	Low	2
2026-08-13 00:17:07	Low	2