ladder

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from source hosted on the project's official GitHub repository, which is a normal and acceptable practice for AUR packages; the recent orphaning and re-adoption is a procedural flag but does not imply malicious intent or supply-chain compromise.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source hosted on the project's official GitHub repository, which is a normal and acceptable practice for AUR packages; the recent orphaning and re-adoption is a procedural flag but does not imply malicious intent or supply-chain compromise.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: tarball <bootctl@gmail.com>
    
      2
    
      3pkgname=ladder
    
      4pkgver=0.0.23
    
      5pkgrel=1
    
      6pkgdesc='Bypass paywalls and remove CORS headers from any URL'
    
      7url='https://github.com/everywall/ladder'
    
      8arch=(i686 x86_64 aarch64 riscv64)
    
      9license=(GPL3)
    
      10depends=(glibc)
    
      11makedepends=(go)
    
      12backup=(etc/$pkgname/ruleset.yaml)
    
      13source=(git+$url.git#tag=v$pkgver ruleset.yaml ladder.service)
    
      14sha256sums=('SKIP'
    
      15            '9717057548ec40f5b9e4caa7d960dd95dd9821eef3cbeffd2110ed5a79e1972d'
    
      16            '3557270490a1e12d6f64a2afad9392225f738d7b551328120cbcfbdb8c192970')
    
      17
    
      18prepare() {
    
      19  cd "$srcdir/$pkgname"
    
      20  go mod download
    
      21  git describe --tags --abbrev=0 >handlers/VERSION
    
      22}
    
      23
    
      24build() {
    
      25  export CGO_CPPFLAGS="$CPPFLAGS"
    
      26  export CGO_CFLAGS="$CFLAGS"
    
      27  export CGO_CXXFLAGS="$CXXFLAGS"
    
      28  export CGO_LDFLAGS="$LDFLAGS"
    
      29  export GOFLAGS='-buildmode=pie -trimpath -mod=readonly -modcacherw'
    
      30
    
      31  cd "$srcdir/$pkgname"
    
      32  go build -o $pkgname ./cmd/main.go
    
      33}
    
      34
    
      35check() {
    
      36  cd "$srcdir/$pkgname"
    
      37  go test ./...
    
      38}
    
      39
    
      40package() {
    
      41  install -Dm644 ruleset.yaml "$pkgdir/etc/$pkgname/ruleset.yaml"
    
      42  install -Dm644 $pkgname.service "$pkgdir/usr/lib/systemd/system/$pkgname.service"
    
      43
    
      44  cd "$srcdir/$pkgname"
    
      45  install -Dm755 $pkgname "$pkgdir/usr/bin/$pkgname"
    
      46}
    
      47

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: tarball <bootctl@gmail.com>
 
 pkgname=ladder
-pkgver=0.0.21
+pkgver=0.0.23
 pkgrel=1
 pkgdesc='Bypass paywalls and remove CORS headers from any URL'
 url='https://github.com/everywall/ladder'

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 09:14:07	MEDIUM	1
2026-07-30 07:14:03	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0