lyrebird-proxy

LOW

maintainer npil 9 votes scanned 2026-08-26 00:12:07.713121

View on AUR

Why flagged

The source is downloaded from the official Tor Project GitLab instance, which is a legitimate and trusted host for this project, despite not being on a standard whitelist; the package builds from source and installs only the resulting binary and license, with no obfuscated or suspicious behavior.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is downloaded from the official Tor Project GitLab instance, which is a legitimate and trusted host for this project, despite not being on a standard whitelist; the package builds from source and installs only the resulting binary and license, with no obfuscated or suspicious behavior.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("$pkgname-$pkgver.tar.bz2::https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/lyrebird/-/archive/lyrebird-$pkgver/lyrebird-lyrebird-$pkgver.tar.bz2")

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: fossdd <fossdd@pwned.life>
    
      2pkgname=lyrebird-proxy
    
      3pkgver=0.6.1
    
      4pkgrel=1
    
      5pkgdesc="pluggable transport proxy for Tor, implementing obfs4"
    
      6url="https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/lyrebird"
    
      7license=('BSD-3-Clause')
    
      8arch=('x86_64' 'aarch64' 'armv7h')
    
      9depends=('glibc')
    
      10makedepends=('go')
    
      11source=("$pkgname-$pkgver.tar.bz2::https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/lyrebird/-/archive/lyrebird-$pkgver/lyrebird-lyrebird-$pkgver.tar.bz2")
    
      12sha256sums=('9b88ae705d9e87c0d0fbec1da58192457c60f56386465abc16d6aa05e6f400a1')
    
      13b2sums=('63c2635212cc0e579c07976543502c9360a7759b0c6c35c40d69c071ea492f61d3050d9e5896284d4c9c3b4510766de4fb78a985f74cd0422d3f2e2ceb287752')
    
      14
    
      15build() {
    
      16  cd "$srcdir/lyrebird-lyrebird-$pkgver"
    
      17
    
      18  export CGO_CPPFLAGS="$CPPFLAGS"
    
      19  export CGO_CFLAGS="$CFLAGS"
    
      20  export CGO_CXXFLAGS="$CXXFLAGS"
    
      21  export CGO_LDFLAGS="$LDFLAGS"
    
      22  export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
    
      23
    
      24  go build -v -o lyrebird ./cmd/lyrebird
    
      25}
    
      26
    
      27package() {
    
      28  cd "$srcdir/lyrebird-lyrebird-$pkgver"
    
      29
    
      30  install -Dm0755 lyrebird "$pkgdir/usr/bin/lyrebird"
    
      31
    
      32  install -Dm0644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-26 00:12:07	Low	3
2026-08-25 23:28:42	Medium	2
2026-06-19 19:07:35	Clean	2
2026-06-18 16:11:54	Medium	1