iceshrimp.net-pre-bin

maintainer zotan · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt binaries from the project's own domain (iceshrimp.dev), which is not on standard whitelists but plausibly official; checksums are provided and the binaries are self-contained, with no evidence of obfuscation or remote code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from the project's own domain (iceshrimp.dev), which is not on standard whitelists but plausibly official; checksums are provided and the binaries are self-contained, with no evidence of obfuscation or remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 source_x86_64=("${pkgname}-${pkgver}-linux_amd64.tar.zst::https://iceshrimp.dev/iceshrimp/Iceshrimp.NET/releases/download/${_pkgver}/Iceshrimp.NET-${_pkgver}-linux-amd64-glibc.tar.zst")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zotan <aur@zotan.email>
    
      2
    
      3_pkgver=v2026.1.2-beta
    
      4
    
      5pkgname=iceshrimp.net-pre-bin
    
      6pkgver=2026.1.2.beta
    
      7pkgrel=1
    
      8pkgdesc="Decentralized and federated social networking service, implementing the ActivityPub standard"
    
      9arch=(x86_64 aarch64)
    
      10url="https://iceshrimp.dev/iceshrimp/iceshrimp.net"
    
      11license=(EUPL)
    
      12
    
      13makedepends=()
    
      14depends=()
    
      15optdepends=(
    
      16  "ffmpeg: for video transcoding"
    
      17)
    
      18
    
      19conflicts=(iceshrimp.net)
    
      20provides=(iceshrimp.net)
    
      21
    
      22backup=("etc/iceshrimp.net/configuration.ini")
    
      23
    
      24install="iceshrimp.net.install"
    
      25
    
      26source_x86_64=("${pkgname}-${pkgver}-linux_amd64.tar.zst::https://iceshrimp.dev/iceshrimp/Iceshrimp.NET/releases/download/${_pkgver}/Iceshrimp.NET-${_pkgver}-linux-amd64-glibc.tar.zst")
    
      27source_aarch64=("${pkgname}-${pkgver}-linux_arm64.tar.zst::https://iceshrimp.dev/iceshrimp/Iceshrimp.NET/releases/download/${_pkgver}/Iceshrimp.NET-${_pkgver}-linux-arm64-glibc.tar.zst")
    
      28
    
      29source=(
    
      30  "iceshrimp.net.service"
    
      31  "iceshrimp.net.sysusers"
    
      32  "iceshrimp.net.tmpfiles"
    
      33  "iceshrimp.net.install"
    
      34  "iceshrimp.net.hook"
    
      35)
    
      36
    
      37sha512sums=('cfb7adf7e9f0d9d05ab89b2237ddf1ef4135ed9dde463e96c7cd94e03e497a85c77a795ac20c09214a2364e675c88e65ac119f6de82a08f5c2d64d657c4b3fc0'
    
      38            '9adf1781842ae7ff2779ca561f06ab2b6fb93e206698084283986627aba69b0fd4482ccbed3daebb2517e5966c326604e1cc57618589f331a966fee2db63815d'
    
      39            '0665aa7af2b2aa4405289ce9119439ddcc6b9e6c81dc8e3b9ed5d8ecdc4a39d49c950d41d3098ce99fe294ce51a2dee55ec7248c1756783b0e9aad0bde4654fa'
    
      40            '0a0467df278f3bd739114725b373f5ec6c7296f609f0a9bcb4f8142b44856fc63e32f76390adf757005035dc691a4c54a662cc8a287572b61e215c29e3d3cbf2'
    
      41            '9c58726b6571268ff4886a6fb8cf6b69db1464d10ef028bae75b93c7fc168abcb6aee3ac9c3c24358805d35e9610ce3102b7270c8ca2e66ec5ad0fbda31f8db9')
    
      42sha512sums_x86_64=('825652c9d8590a444efb19ab933f00ae20a1bd430fe070abf467927a894528a8f992d7654d3464583c0cb64a0130bc24d0aa1b3d57d14fdeee7e1546b4b4ea22')
    
      43sha512sums_aarch64=('3bd758d8ddd3e4b7172a9ef4d8b7c9b90b7b7802ab9b52b443060bd0d1783a1d880dd0ab9863677f8317c7edc38e229b10bb94813c5bc1026a0e8ba2d12326a2')
    
      44
    
      45pkgver() {
    
      46  local res
    
      47  res=${_pkgver//-/.} # Replace dashes with dots
    
      48  res=${res:1} # Trim leading 'v'
    
      49
    
      50  echo -n "$res"
    
      51
    
      52  if [[ ${#res} -eq 7 ]]; then
    
      53    echo -n ".0" # Append .0 to major releases to make sure they sort correctly against prereleases
    
      54  fi
    
      55}
    
      56
    
      57package() {
    
      58  # Add runtime-only dependencies
    
      59  depends+=(postgresql libvips openjpeg2)
    
      60
    
      61  # Since we're using the release tarballs, we only need the runtime after installation
    
      62  depends+=('aspnet-runtime>=10.0' 'aspnet-runtime<11.0')
    
      63
    
      64  install -dm 755 "${pkgdir}/usr/share/iceshrimp.net"
    
      65  install -dm 755 "${pkgdir}/etc/iceshrimp.net"
    
      66
    
      67  targetarch=${CARCH/x86_64/amd64}
    
      68  targetarch=${targetarch/aarch64/arm64}
    
      69  xdir="${srcdir}/Iceshrimp.NET-${_pkgver}-linux-${targetarch}-glibc"
    
      70
    
      71  # We are requiring libvips as a system dependency, so we can safely delete this
    
      72  rm "${xdir}/libvips.so."*
    
      73
    
      74  install -Dm 644 "${srcdir}/iceshrimp.net.service" "${pkgdir}/usr/lib/systemd/system/iceshrimp.net.service"
    
      75  install -Dm 644 "${srcdir}/iceshrimp.net.sysusers" "${pkgdir}/usr/lib/sysusers.d/iceshrimp.net.conf"
    
      76  install -Dm 644 "${srcdir}/iceshrimp.net.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/iceshrimp.net.conf"
    
      77  install -Dm 644 "${srcdir}/iceshrimp.net.hook" "${pkgdir}/usr/share/libalpm/hooks/iceshrimp.net.hook"
    
      78  install -Dm 640 "${xdir}/configuration.ini" "${pkgdir}/etc/iceshrimp.net/configuration.ini"
    
      79
    
      80  cp -dpTr --no-preserve=ownership "${xdir}/" "${pkgdir}/usr/share/iceshrimp.net"
    
      81}
    
      82

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,9 +1,9 @@
 # Maintainer: zotan <aur@zotan.email>
 
-_pkgver=v2026.1.1-beta
+_pkgver=v2026.1.2-beta
 
 pkgname=iceshrimp.net-pre-bin
-pkgver=2026.1.1.beta
+pkgver=2026.1.2.beta
 pkgrel=1
 pkgdesc="Decentralized and federated social networking service, implementing the ActivityPub standard"
 arch=(x86_64 aarch64)
@@ -39,8 +39,8 @@
             '0665aa7af2b2aa4405289ce9119439ddcc6b9e6c81dc8e3b9ed5d8ecdc4a39d49c950d41d3098ce99fe294ce51a2dee55ec7248c1756783b0e9aad0bde4654fa'
             '0a0467df278f3bd739114725b373f5ec6c7296f609f0a9bcb4f8142b44856fc63e32f76390adf757005035dc691a4c54a662cc8a287572b61e215c29e3d3cbf2'
             '9c58726b6571268ff4886a6fb8cf6b69db1464d10ef028bae75b93c7fc168abcb6aee3ac9c3c24358805d35e9610ce3102b7270c8ca2e66ec5ad0fbda31f8db9')
-sha512sums_x86_64=('0b13f7809fc190707550bb87c815c8988deb90f76af626348150d86e51dfa64758a15838414226984be56056cdb3af9378f5497a8f87eacbce9f81e073d03c9e')
-sha512sums_aarch64=('8419a4b7490427092ddfa1bf67aa9e989c65c346d379aec36638eb06a4cc189fdbf8c35dddf3d149495132efd8ced7d079d40e78038ce09bc59dac69b75b01dc')
+sha512sums_x86_64=('825652c9d8590a444efb19ab933f00ae20a1bd430fe070abf467927a894528a8f992d7654d3464583c0cb64a0130bc24d0aa1b3d57d14fdeee7e1546b4b4ea22')
+sha512sums_aarch64=('3bd758d8ddd3e4b7172a9ef4d8b7c9b90b7b7802ab9b52b443060bd0d1783a1d880dd0ab9863677f8317c7edc38e229b10bb94813c5bc1026a0e8ba2d12326a2')
 
 pkgver() {
   local res

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 17:15:21	MEDIUM	1
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2