ipmikvm

LOW

maintainer cwrau 0 votes base vcutil scanned 2026-09-15 09:19:41.533386

View on AUR

Why flagged

The eval is used to dynamically define package functions from a controlled source (local associative arrays), not to execute untrusted or remote code, posing minimal risk.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The eval is used to dynamically define package functions from a controlled source (local associative arrays), not to execute untrusted or remote code, posing minimal risk.

PKGBUILD:29 eval "$pkgfun"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer Chris Werner Rau <aur@cwrau.io>
    
      2
    
      3pkgbase=vcutil
    
      4pkgname=(ipmikvm)
    
      5pkgver=1.63 # renovate: datasource=github-tags depName=ossobv/vcutil
    
      6pkgrel=1
    
      7pkgdesc="Misc. simple utilities to aid version control and host maintenance."
    
      8license=()
    
      9arch=('any')
    
      10depends=()
    
      11url=https://github.com/ossobv/vcutil
    
      12source=("$pkgbase-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
    
      13sha512sums=('d3fff81431566e6642fcb57ad111c9e668cd9aa32d463b93d896448d3df5a5a0c897cb9d9803f4fa21b0a317c4b189b45f42c82d37edcb819be5d7585ed2fae5')
    
      14
    
      15declare -A pkgdescs
    
      16pkgdescs=([ipmikvm]="A wrapper to call the SuperMicro iKVM console bypassing Java browser plugins.")
    
      17declare -A pkgdepends
    
      18pkgdepends=([ipmikvm]="jre8-openjdk-headless unzip curl awk coreutils")
    
      19
    
      20for package in "${pkgname[@]}"; do
    
      21  read -r -d '' pkgfun <<EOF
    
      22function package_${package}() {
    
      23  pkgdesc="${pkgdescs[$package]}"
    
      24  depends=( ${pkgdepends[$package]} )
    
      25
    
      26  install -Dm 755 "\$srcdir/$pkgbase-$pkgver/$package" -t "\$pkgdir/usr/bin"
    
      27}
    
      28EOF
    
      29  eval "$pkgfun"
    
      30done
    
      31

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-09-15 09:19
@@ -2,7 +2,7 @@
 
 pkgbase=vcutil
 pkgname=(ipmikvm)
-pkgver=1.62 # renovate: datasource=github-tags depName=ossobv/vcutil
+pkgver=1.63 # renovate: datasource=github-tags depName=ossobv/vcutil
 pkgrel=1
 pkgdesc="Misc. simple utilities to aid version control and host maintenance."
 license=()
@@ -10,7 +10,7 @@
 depends=()
 url=https://github.com/ossobv/vcutil
 source=("$pkgbase-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
-sha512sums=('6f0e6d96c68523101868b9fc8eb07831052e17633ef3db18ff660ddbbff7c3f8627b51fdaa57b475e7672f7376fa659baf73e3017e2a9bf7bd71bbcb45cfb93b')
+sha512sums=('d3fff81431566e6642fcb57ad111c9e668cd9aa32d463b93d896448d3df5a5a0c897cb9d9803f4fa21b0a317c4b189b45f42c82d37edcb819be5d7585ed2fae5')
 
 declare -A pkgdescs
 pkgdescs=([ipmikvm]="A wrapper to call the SuperMicro iKVM console bypassing Java browser plugins.")

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-15 09:19:41	Low	1
2026-06-18 16:11:54	Clean	0