iceshrimp.net

maintainer zotan · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a Git repository hosted on the project's own domain (iceshrimp.dev), which is not a standard forge like GitHub but plausibly legitimate for the project; it builds from source, not a prebuilt binary, and no malicious behavior is evident.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a Git repository hosted on the project's own domain (iceshrimp.dev), which is not a standard forge like GitHub but plausibly legitimate for the project; it builds from source, not a prebuilt binary, and no malicious behavior is evident.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 "iceshrimp.net::git+https://iceshrimp.dev/iceshrimp/iceshrimp.net.git#tag=${_pkgver}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zotan <aur@zotan.email>
    
      2
    
      3_pkgver=v2026.1.2-beta
    
      4
    
      5pkgname=iceshrimp.net
    
      6pkgver=2026.1.2.beta
    
      7pkgrel=1
    
      8pkgdesc="Decentralized and federated social networking service, implementing the ActivityPub standard"
    
      9arch=(x86_64 aarch64)
    
      10url="https://iceshrimp.dev/iceshrimp/iceshrimp.net"
    
      11license=(EUPL)
    
      12
    
      13makedepends=('dotnet-sdk>=10.0' 'aspnet-targeting-pack>=10.0' 'aspnet-targeting-pack<11.0')
    
      14depends=('aspnet-runtime>=10.0' 'aspnet-runtime<11.0')
    
      15optdepends=(
    
      16  "ffmpeg: for video transcoding"
    
      17)
    
      18
    
      19backup=("etc/iceshrimp.net/configuration.ini")
    
      20
    
      21install="iceshrimp.net.install"
    
      22
    
      23source=(
    
      24  "iceshrimp.net::git+https://iceshrimp.dev/iceshrimp/iceshrimp.net.git#tag=${_pkgver}"
    
      25  "iceshrimp.net.service"
    
      26  "iceshrimp.net.sysusers"
    
      27  "iceshrimp.net.tmpfiles"
    
      28  "iceshrimp.net.install"
    
      29  "iceshrimp.net.hook"
    
      30)
    
      31
    
      32sha512sums=('c157c04660f4b0dbffd5ed997f984f9310296f7a6344c022035718ee0673297a9a7abf2ba5d4fafb8fe1fe834ca6c807e30cc48b6d177da532cf7a9fe5ded652'
    
      33            'cfb7adf7e9f0d9d05ab89b2237ddf1ef4135ed9dde463e96c7cd94e03e497a85c77a795ac20c09214a2364e675c88e65ac119f6de82a08f5c2d64d657c4b3fc0'
    
      34            '9adf1781842ae7ff2779ca561f06ab2b6fb93e206698084283986627aba69b0fd4482ccbed3daebb2517e5966c326604e1cc57618589f331a966fee2db63815d'
    
      35            '0665aa7af2b2aa4405289ce9119439ddcc6b9e6c81dc8e3b9ed5d8ecdc4a39d49c950d41d3098ce99fe294ce51a2dee55ec7248c1756783b0e9aad0bde4654fa'
    
      36            '0a0467df278f3bd739114725b373f5ec6c7296f609f0a9bcb4f8142b44856fc63e32f76390adf757005035dc691a4c54a662cc8a287572b61e215c29e3d3cbf2'
    
      37            '78c4eb031a3e9e6976760c3b3016fc3ff6d764aa123140dbf095d3834c7e8af2f4490a0874394f43e320c421136aa87388b309f3b181336347510fcc82d590c7')
    
      38
    
      39pkgver() {
    
      40  local res
    
      41  res=${_pkgver//-/.} # Replace dashes with dots
    
      42  res=${res:1} # Trim leading 'v'
    
      43
    
      44  echo -n "$res"
    
      45
    
      46  if [[ ${#res} -eq 7 ]]; then
    
      47    echo -n ".0" # Append .0 to major releases to make sure they sort correctly against prereleases
    
      48  fi
    
      49}
    
      50
    
      51rid() {
    
      52  if [[ $CARCH == "x86_64" ]]; then
    
      53    echo -n "linux-x64"
    
      54  else
    
      55    echo -n "linux-arm64"
    
      56  fi
    
      57}
    
      58
    
      59sdkver() {
    
      60  cat "${srcdir}/iceshrimp.net/Directory.Build.props" | grep -oP '(?<=<TargetFramework>).*?(?=</TargetFramework>)'
    
      61}
    
      62
    
      63build() {
    
      64  cd "${srcdir}/iceshrimp.net/Iceshrimp.Backend"
    
      65
    
      66  if [[ -n $DISABLE_VIPS ]]; then
    
      67    VIPS=false
    
      68  else
    
      69    VIPS=true
    
      70  fi
    
      71
    
      72  if [[ -n $DISABLE_AOT ]] || ! dotnet workload list | grep -q '^wasm-tools\s'; then
    
      73    dotnet publish -c Release -r $(rid) -p:EnableLibVips=$VIPS -p:DeterministicSourcePaths=true -p:ContinuousIntegrationBuild=true
    
      74  else
    
      75    dotnet publish -c Release -r $(rid) -p:EnableAOT=true -p:EnableLibVips=$VIPS -p:DeterministicSourcePaths=true -p:ContinuousIntegrationBuild=true
    
      76  fi
    
      77}
    
      78
    
      79package() {
    
      80  # Add runtime-only dependencies
    
      81  depends+=(postgresql)
    
      82
    
      83  if [[ -n $DISABLE_VIPS ]]; then
    
      84    # Add runtime-only dependencies for libvips image processing
    
      85    depends+=(libvips openjpeg2)
    
      86  fi
    
      87
    
      88  install -dm 755 "${pkgdir}/usr/share/iceshrimp.net"
    
      89  install -dm 755 "${pkgdir}/etc/iceshrimp.net"
    
      90
    
      91  install -Dm 644 "${srcdir}/iceshrimp.net/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      92  install -Dm 644 "${srcdir}/iceshrimp.net.service" "${pkgdir}/usr/lib/systemd/system/iceshrimp.net.service"
    
      93  install -Dm 644 "${srcdir}/iceshrimp.net.sysusers" "${pkgdir}/usr/lib/sysusers.d/iceshrimp.net.conf"
    
      94  install -Dm 644 "${srcdir}/iceshrimp.net.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/iceshrimp.net.conf"
    
      95  install -Dm 644 "${srcdir}/iceshrimp.net.hook" "${pkgdir}/usr/share/libalpm/hooks/iceshrimp.net.hook"
    
      96  install -Dm 640 "${srcdir}/iceshrimp.net/Iceshrimp.Backend/configuration.ini" "${pkgdir}/etc/iceshrimp.net/configuration.ini"
    
      97
    
      98  cp -dpTr --no-preserve=ownership "${srcdir}/iceshrimp.net/Iceshrimp.Backend/bin/Release/$(sdkver)/$(rid)/publish/" "${pkgdir}/usr/share/iceshrimp.net"
    
      99}
    
      100

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,9 +1,9 @@
 # Maintainer: zotan <aur@zotan.email>
 
-_pkgver=v2026.1.1-beta
+_pkgver=v2026.1.2-beta
 
 pkgname=iceshrimp.net
-pkgver=2026.1.1.beta
+pkgver=2026.1.2.beta
 pkgrel=1
 pkgdesc="Decentralized and federated social networking service, implementing the ActivityPub standard"
 arch=(x86_64 aarch64)
@@ -29,7 +29,7 @@
   "iceshrimp.net.hook"
 )
 
-sha512sums=('26ae31b72e2744f067cafe3f12a3122dd34d73c0f238569c8ab0484ac988e6935210d0713d3c0bc0e2685c46bdce6bec116db38b7abc4b7ced55b9c3cf7b1a49'
+sha512sums=('c157c04660f4b0dbffd5ed997f984f9310296f7a6344c022035718ee0673297a9a7abf2ba5d4fafb8fe1fe834ca6c807e30cc48b6d177da532cf7a9fe5ded652'
             'cfb7adf7e9f0d9d05ab89b2237ddf1ef4135ed9dde463e96c7cd94e03e497a85c77a795ac20c09214a2364e675c88e65ac119f6de82a08f5c2d64d657c4b3fc0'
             '9adf1781842ae7ff2779ca561f06ab2b6fb93e206698084283986627aba69b0fd4482ccbed3daebb2517e5966c326604e1cc57618589f331a966fee2db63815d'
             '0665aa7af2b2aa4405289ce9119439ddcc6b9e6c81dc8e3b9ed5d8ecdc4a39d49c950d41d3098ce99fe294ce51a2dee55ec7248c1756783b0e9aad0bde4654fa'

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-19 19:07:35	CLEAN	2
2026-06-18 16:11:54	MEDIUM	1