isc-stork

LOW

maintainer orphaned 0 votes scanned 2026-10-20 15:30:09.239925

View on AUR

Why flagged

Source tarball is fetched directly from the official ISC GitLab instance (gitlab.isc.org), which is the project's own infrastructure; the build uses rake to compile from source with no obfuscated payloads or untrusted remote downloads at runtime. The only minor concern is a low-vote, recently uploaded package, but the packaging itself is straightforward and not dangerous.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Source tarball is fetched directly from the official ISC GitLab instance (gitlab.isc.org), which is the project's own infrastructure; the build uses rake to compile from source with no obfuscated payloads or untrusted remote downloads at runtime. The only minor concern is a low-vote, recently uploaded package, but the packaging itself is straightforward and not dangerous.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://gitlab.isc.org/isc-projects/${_pkgname}/-/archive/v${pkgver}/${_pkg}.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1pkgname='isc-stork'
    
      2pkgver='1.8.0'
    
      3pkgrel='1'
    
      4pkgdesc="A dashboard for BIND 9 and Kea DHCP."
    
      5arch=('x86_64')
    
      6url='https://gitlab.isc.org/isc-projects/stork'
    
      7license=('MPL2')
    
      8depends=('glibc')
    
      9makedepends=('git' 'java-environment' 'python' 'rake' 'unzip' 'wget')
    
      10backup=('etc/stork')
    
      11_pkgname='stork'
    
      12_pkg="${_pkgname}-v${pkgver}"
    
      13source=("https://gitlab.isc.org/isc-projects/${_pkgname}/-/archive/v${pkgver}/${_pkg}.tar.gz"
    
      14        "isc-stork.sysuser")
    
      15sha512sums=('8c86eac4fe54052bc7e9570617105bd31499e4c7f5a89fb2b0f859367591de1fb320f43cdeedb3c6ef004e1f785545a8ec12ac7bd37cac8c15706a3e182d8bfd'
    
      16            '524a319ab3b938bdab902b82c99744dcbf90cf5b44dc2bc7003b5fac7b77f6bb07d260c7f5cdd3fee8d3f673ca23611b00d1ded27a96da6fcb85d16e70b7a580')
    
      17
    
      18build() {
    
      19  tar -xzf "${_pkg}.tar.gz"
    
      20  cd "${_pkg}"
    
      21  export CGO_CPPFLAGS="${CPPFLAGS}"
    
      22  export CGO_CFLAGS="${CFLAGS}"
    
      23  export CGO_CXXFLAGS="${CXXFLAGS}"
    
      24  export CGO_LDFLAGS="${LDFLAGS}"
    
      25  export GOFLAGS='-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw'
    
      26  rake build
    
      27}
    
      28
    
      29package() {
    
      30  cd "${_pkg}"
    
      31  rake install:server DEST="${pkgdir}"
    
      32  mkdir -p "${pkgdir}/usr/share"
    
      33  mv "${pkgdir}/man" "${pkgdir}/usr/share"
    
      34  mv "${pkgdir}/lib" "${pkgdir}/usr"
    
      35  install -Dm644 "${srcdir}/isc-stork.sysuser" "${pkgdir}/usr/lib/sysusers.d/isc-stork.conf"
    
      36}
    
      37
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-20 15:30:09	Low	3
2026-10-20 15:28:05	Medium	2