iceshrimp.net-bin
LOW
maintainer zotan
2 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads prebuilt release binaries from the project's own domain (iceshrimp.dev) which is not on the static analyzer's whitelist, but the binaries are verified via sha512sums; the worst case of a malicious swap is limited to running unreviewed code, but the source is plausibly official and the checksums are provided, reducing risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt release binaries from the project's own domain (iceshrimp.dev) which is not on the static analyzer's whitelist, but the binaries are verified via sha512sums; the worst case of a malicious swap is limited to running unreviewed code, but the source is plausibly official and the checksums are provided, reducing risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:26
source_x86_64=("${pkgname}-${pkgver}-linux_amd64.tar.zst::https://iceshrimp.dev/iceshrimp/Iceshrimp.NET/releases/download/${_pkgver}/Iceshrimp.NET-${_pkgver}-linux-amd64-glibc.tar.zst")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zotan <aur@zotan.email>
2
3
_pkgver=v2026.1.2-beta
4
5
pkgname=iceshrimp.net-bin
6
pkgver=2026.1.2.beta
7
pkgrel=1
8
pkgdesc="Decentralized and federated social networking service, implementing the ActivityPub standard"
9
arch=(x86_64 aarch64)
10
url="https://iceshrimp.dev/iceshrimp/iceshrimp.net"
11
license=(EUPL)
12
13
makedepends=()
14
depends=()
15
optdepends=(
16
"ffmpeg: for video transcoding"
17
)
18
19
conflicts=(iceshrimp.net)
20
provides=(iceshrimp.net)
21
22
backup=("etc/iceshrimp.net/configuration.ini")
23
24
install="iceshrimp.net.install"
25
26
source_x86_64=("${pkgname}-${pkgver}-linux_amd64.tar.zst::https://iceshrimp.dev/iceshrimp/Iceshrimp.NET/releases/download/${_pkgver}/Iceshrimp.NET-${_pkgver}-linux-amd64-glibc.tar.zst")
27
source_aarch64=("${pkgname}-${pkgver}-linux_arm64.tar.zst::https://iceshrimp.dev/iceshrimp/Iceshrimp.NET/releases/download/${_pkgver}/Iceshrimp.NET-${_pkgver}-linux-arm64-glibc.tar.zst")
28
29
source=(
30
"iceshrimp.net.service"
31
"iceshrimp.net.sysusers"
32
"iceshrimp.net.tmpfiles"
33
"iceshrimp.net.install"
34
"iceshrimp.net.hook"
35
)
36
37
sha512sums=('cfb7adf7e9f0d9d05ab89b2237ddf1ef4135ed9dde463e96c7cd94e03e497a85c77a795ac20c09214a2364e675c88e65ac119f6de82a08f5c2d64d657c4b3fc0'
38
'9adf1781842ae7ff2779ca561f06ab2b6fb93e206698084283986627aba69b0fd4482ccbed3daebb2517e5966c326604e1cc57618589f331a966fee2db63815d'
39
'0665aa7af2b2aa4405289ce9119439ddcc6b9e6c81dc8e3b9ed5d8ecdc4a39d49c950d41d3098ce99fe294ce51a2dee55ec7248c1756783b0e9aad0bde4654fa'
40
'0a0467df278f3bd739114725b373f5ec6c7296f609f0a9bcb4f8142b44856fc63e32f76390adf757005035dc691a4c54a662cc8a287572b61e215c29e3d3cbf2'
41
'6e17d76acea901a753d2be261e17fc4113351b17f060c9eaf5cb878d6b6ab38c26efb3982411454626be4a0d21845e74ebef5efe18b11ac19b52e9c55442466a')
42
sha512sums_x86_64=('825652c9d8590a444efb19ab933f00ae20a1bd430fe070abf467927a894528a8f992d7654d3464583c0cb64a0130bc24d0aa1b3d57d14fdeee7e1546b4b4ea22')
43
sha512sums_aarch64=('3bd758d8ddd3e4b7172a9ef4d8b7c9b90b7b7802ab9b52b443060bd0d1783a1d880dd0ab9863677f8317c7edc38e229b10bb94813c5bc1026a0e8ba2d12326a2')
44
45
pkgver() {
46
local res
47
res=${_pkgver//-/.} # Replace dashes with dots
48
res=${res:1} # Trim leading 'v'
49
50
echo -n "$res"
51
52
if [[ ${#res} -eq 7 ]]; then
53
echo -n ".0" # Append .0 to major releases to make sure they sort correctly against prereleases
54
fi
55
}
56
57
package() {
58
# Add runtime-only dependencies
59
depends+=(postgresql libvips openjpeg2)
60
61
# Since we're using the release tarballs, we only need the runtime after installation
62
depends+=('aspnet-runtime>=10.0' 'aspnet-runtime<11.0')
63
64
install -dm 755 "${pkgdir}/usr/share/iceshrimp.net"
65
install -dm 755 "${pkgdir}/etc/iceshrimp.net"
66
67
targetarch=${CARCH/x86_64/amd64}
68
targetarch=${targetarch/aarch64/arm64}
69
xdir="${srcdir}/Iceshrimp.NET-${_pkgver}-linux-${targetarch}-glibc"
70
71
# We are requiring libvips as a system dependency, so we can safely delete this
72
rm "${xdir}/libvips.so."*
73
74
install -Dm 644 "${srcdir}/iceshrimp.net.service" "${pkgdir}/usr/lib/systemd/system/iceshrimp.net.service"
75
install -Dm 644 "${srcdir}/iceshrimp.net.sysusers" "${pkgdir}/usr/lib/sysusers.d/iceshrimp.net.conf"
76
install -Dm 644 "${srcdir}/iceshrimp.net.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/iceshrimp.net.conf"
77
install -Dm 644 "${srcdir}/iceshrimp.net.hook" "${pkgdir}/usr/share/libalpm/hooks/iceshrimp.net.hook"
78
install -Dm 640 "${xdir}/configuration.ini" "${pkgdir}/etc/iceshrimp.net/configuration.ini"
79
80
cp -dpTr --no-preserve=ownership "${xdir}/" "${pkgdir}/usr/share/iceshrimp.net"
81
}
82
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |