mgmt

maintainer fujexo · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The flagged external installs are development tools (goyacc, stringer, golint, etc.) required for building the Go project, not arbitrary third-party applications, and are fetched directly from official Go module paths as part of the standard build process.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged external installs are development tools (goyacc, stringer, golint, etc.) required for building the Go project, not arbitrary third-party applications, and are fetched directly from official Go module paths as part of the standard build process.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:40 go install github.com/blynn/nex@latest
PKGBUILD:41 go install golang.org/x/tools/cmd/goyacc@latest
PKGBUILD:42 go install golang.org/x/tools/cmd/stringer@latest
PKGBUILD:43 go install golang.org/x/lint/golint@latest
PKGBUILD:44 go install golang.org/x/tools/cmd/goimports@latest
PKGBUILD:45 go install github.com/dvyukov/go-fuzz/go-fuzz@latest

PKGBUILD

6 offending line(s) highlighted

      1# $Id$
    
      2# Maintainer: Philipp Marmet
    
      3# Contributor: Joe Julian
    
      4
    
      5pkgname=mgmt
    
      6pkgver=1.1.0
    
      7pkgrel=0
    
      8epoch=1
    
      9pkgdesc='Next generation config management.'
    
      10arch=('x86_64' 'i686' 'armv6h' 'armv7h')
    
      11pkggopath='github.com/purpleidea/mgmt'
    
      12url="https://${pkggopath}"
    
      13license=('GPL3')
    
      14makedepends=('augeas' 'go' 'go-md2man' 'go-tools' 'libpcap' 'libvirt' 'rubygems' 'ragel6')
    
      15depends=('augeas' 'libvirt')
    
      16conflicts=('mgmt-bin')
    
      17# don't strip binaries! A sha1 is used to check binary consistency.
    
      18options=('!strip')
    
      19backup=("etc/${pkgname}/${pkgname}.conf")
    
      20
    
      21source=("${pkgname}-${pkgver}.tar.gz"::"${url}/archive/refs/tags/${pkgver}.tar.gz"
    
      22  "mgmt.service")
    
      23sha256sums=('91c18b48e7c73f02bd5a896c155787440aa868ce806a42be0d6df884b0a87494'
    
      24  'eeb4174a8556161b94f62808b4453ef91574797070ada53ffb90cb013aff9799')
    
      25
    
      26prepare() {
    
      27  # extract tarball to path expected by go
    
      28  mkdir -p "${srcdir}/src/${pkggopath}"
    
      29  cd "${srcdir}/${pkgname}-${pkgver}"
    
      30
    
      31  git submodule --quiet update --init --recursive
    
      32  git archive --prefix="${pkggopath}/" --format="tar" HEAD | tar xf - -C "${srcdir}/src"
    
      33  git submodule foreach 'git archive --prefix="${path}/" --format="tar" HEAD | tar xvf - -C "'${srcdir}'/src/'${pkggopath}'"'
    
      34
    
      35  # fetch dependencies
    
      36  export GOPATH="${srcdir}"
    
      37  export PATH=${GOPATH}/bin:${PATH}
    
      38  cd "${srcdir}/src/${pkggopath}"
    
      39  msg2 'installing go dependencies'
    
      40  go install github.com/blynn/nex@latest
    
      41  go install golang.org/x/tools/cmd/goyacc@latest      # formerly `go tool yacc`
    
      42  go install golang.org/x/tools/cmd/stringer@latest    # for automatic stringer-ing
    
      43  go install golang.org/x/lint/golint@latest           # for `golint`-ing
    
      44  go install golang.org/x/tools/cmd/goimports@latest   # for fmt
    
      45  go install github.com/dvyukov/go-fuzz/go-fuzz@latest # for fuzzing the mcl lang bits
    
      46
    
      47}
    
      48
    
      49build() {
    
      50  export GOPATH="${srcdir}"
    
      51  export PATH=${GOPATH}/bin:${PATH}:/usr/lib/go/pkg/tool/linux_amd64
    
      52  cd "${srcdir}/${pkgname}-${pkgver}"
    
      53  go mod tidy
    
      54  make VERSION="${pkgver}" SVERSION="${pkgver}" PROGRAM="${pkgname}"
    
      55}
    
      56
    
      57package() {
    
      58  msg2 'installing files'
    
      59  install -Dm644 "mgmt.service" "${pkgdir}/usr/lib/systemd/system/mgmt.service"
    
      60
    
      61  cd "${srcdir}/${pkgname}-${pkgver}"
    
      62  install -Dm755 "${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      63  install -Dm644 "misc/bashrc.sh" "${pkgdir}/usr/share/bash-completion/completions/${pkgname}"
    
      64  install -Dm644 "misc/example.conf" "${pkgdir}/etc/${pkgname}/${pkgname}.conf"
    
      65}
    
      66

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2