micromamba-bin

maintainer carlosal1015 · 25 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt binaries from conda-forge's official API endpoint, which is a standard and trusted source for the project; although the host is not whitelisted, the download is verifiable via sha512sums and originates from the legitimate upstream distribution infrastructure.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from conda-forge's official API endpoint, which is a standard and trusted source for the project; although the host is not whitelisted, the download is verifiable via sha512sums and originates from the legitimate upstream distribution infrastructure.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source_x86_64=(${pkgname%-bin}-${pkgver}-x86_64.tar.bz2::https://api.anaconda.org/download/conda-forge/${pkgname%-bin}/${pkgver%.*}/linux-64/${pkgname%-bin}-${_pkgver}.tar.bz2)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ashwin Vishnu <y4d71nsar@relay.firefox.com>
    
      2# Maintainer: Carlos Aznarán <caznaranl@uni.pe>
    
      3# Contributor: Corpswalker <corpswalker@gmail.com>
    
      4pkgname=micromamba-bin
    
      5pkgver=2.8.1.0
    
      6_pkgver=${pkgver%.*}-${pkgver##*.}
    
      7pkgrel=1
    
      8pkgdesc="Tiny version of mamba, the fast conda package installer"
    
      9arch=(x86_64 aarch64 powerpc64le)
    
      10url="https://github.com/mamba-org/mamba"
    
      11license=(BSD-3-clause)
    
      12source_x86_64=(${pkgname%-bin}-${pkgver}-x86_64.tar.bz2::https://api.anaconda.org/download/conda-forge/${pkgname%-bin}/${pkgver%.*}/linux-64/${pkgname%-bin}-${_pkgver}.tar.bz2)
    
      13source_aarch64=(${pkgname%-bin}-${pkgver}-aarch64.tar.bz2::https://api.anaconda.org/download/conda-forge/${pkgname%-bin}/${pkgver%.*}/linux-aarch64/${pkgname%-bin}-${_pkgver}.tar.bz2)
    
      14source_powerpc64le=(${pkgname%-bin}-${pkgver}-powerpc64le.tar.bz2::https://api.anaconda.org/download/conda-forge/${pkgname%-bin}/${pkgver%.*}/linux-ppc64le/${pkgname%-bin}-${_pkgver}.tar.bz2)
    
      15options=(strip)
    
      16depends=(glibc)
    
      17provides=("${pkgname%-bin}")
    
      18conflicts=("${pkgname%-bin}")
    
      19sha512sums_x86_64=('b53c0becb49faebf14a650b374a28e6316811230b1470cf91fd0b5edd70b9c18503eb35399cad832f350b6193403bf3f785d4cc89285f1f109d2dcfbe69d586f')
    
      20sha512sums_aarch64=('dc5fd52263f95c68486002c1e6a0aa097324e52948e3ea5861f581ab62eb0b0b7b7461b88eb02b8e6fb24bcd83feb7421042a184edf35c5bb3c2945da6039040')
    
      21sha512sums_powerpc64le=('ccb957c440ae2613d6bc6a33b82a4783dda370e570892f8b51b6dc25eb9af50ee4213d02d904660b479ac7a8c0206df46eccba2722a1cac232de07a0cf117c29')
    
      22
    
      23check() {
    
      24  export PREFIX="${srcdir}"
    
      25  export PATH="${PREFIX}/bin:${PATH}"
    
      26  echo "Testing with ${PREFIX}/bin/${pkgname%-bin}"
    
      27  bash info/test/run_test.sh
    
      28}
    
      29
    
      30package() {
    
      31  install -Dm775 "bin/${pkgname%-bin}" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      32  install -Dm 644 info/licenses/mamba/LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2