libmdbx

maintainer erthink · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a tarball from the project's own official domain, used to build the library from source; the non-whitelisted host is the project's legitimate release infrastructure, so the download is expected and non-malicious.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the project's own official domain, used to build the library from source; the non-whitelisted host is the project's legitimate release infrastructure, so the download is expected and non-malicious.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("$pkgname-$pkgver.tar.xz::https://libmdbx.dqdkfa.ru/release/libmdbx-amalgamated-$pkgver.tar.xz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Леонид Юрьев (Leonid Yuriev) <leo@yuriev.ru>
    
      2# Contributor: Леонид Юрьев (Leonid Yuriev) <leo@yuriev.ru>
    
      3# Contributor: Noel Kuntze <noel.kuntze@thermi.consulting>
    
      4pkgname=libmdbx
    
      5pkgver=0.13.11
    
      6pkgrel=1
    
      7pkgdesc="One of the fastest compact key-value ACID database without WAL, which surpasses the legendary LMDB in terms of reliability, features and performance. At the end of 2024 MDBX was chosen by all modern Ethereum nodes as a storage engine."
    
      8url="https://libmdbx.dqdkfa.ru/"
    
      9arch=('x86_64' 'i686' 'ARM' 'aarch64' 'powerpc64le')
    
      10license=('Apache-2')
    
      11depends=('glibc')
    
      12subpackages="$pkgname-dev $pkgname-doc $pkgname-dbg"
    
      13source=("$pkgname-$pkgver.tar.xz::https://libmdbx.dqdkfa.ru/release/libmdbx-amalgamated-$pkgver.tar.xz")
    
      14sha256sums=('0b3c86131147c4e23164fbbda03c120fde36eb4f38896dfa9ef6abc88f75f9c3')
    
      15
    
      16build() {
    
      17	make -C "$srcdir" \
    
      18		DESTDIR="$pkgdir" prefix=/usr \
    
      19		CFLAGS="$CFLAGS -std=gnu11 -ffunction-sections -fPIC -fvisibility=hidden -pthread" \
    
      20		CXXFLAGS="$CXXFLAGS -std=gnu++20 -ffunction-sections -fPIC -fvisibility=hidden -pthread" \
    
      21		lib-shared tools
    
      22}
    
      23
    
      24check() {
    
      25	echo "  Testing a storage engine is a very voluminous and complex task that requires many hours of processor time."
    
      26	echo "  Any simple tests will only verify the success of the build and create an unjustified illusion."
    
      27	echo "  Therefore, full-fledged testing of libmdbx is performed during development and releasing, but the test framework used for this purpose is not included in the amalgamated source code of libmdbx releases."
    
      28	echo "  The users are invited to use their own integration and functional tests, and if necessary to test libmdbx itself use a whole source code from the git repository."
    
      29}
    
      30
    
      31package() {
    
      32	make -C "$srcdir" \
    
      33		DESTDIR="$pkgdir" prefix=/usr \
    
      34		CFLAGS="$CFLAGS -std=gnu11 -ffunction-sections -fPIC -fvisibility=hidden -pthread" \
    
      35		CXXFLAGS="$CXXFLAGS -std=gnu++20 -ffunction-sections -fPIC -fvisibility=hidden -pthread" \
    
      36		install-no-strip
    
      37}
    
      38
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2