mill

LOW

maintainer gonsolo 0 votes scanned 2026-10-19 00:03:55.276608

View on AUR

Why flagged

The source is a build tool binary from Maven Central, a reputable and official source for Java/Scala artifacts; while not on a standard GitHub/GitLab host, it is a legitimate release location for this project, and the checksum ensures integrity.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a build tool binary from Maven Central, a reputable and official source for Java/Scala artifacts; while not on a standard GitHub/GitLab host, it is a legitimate release location for this project, and the checksum ensures integrity.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("mill-binary::https://repo1.maven.org/maven2/com/lihaoyi/mill-dist/$pkgver/mill-dist-$pkgver-mill.sh")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Andreas Wendleder <gonsolo@gmail.com>
    
      2
    
      3pkgname=mill
    
      4pkgver=1.1.8
    
      5pkgrel=1
    
      6pkgdesc="A shiny new build tool for Java and Scala, designed for performance and reliability"
    
      7arch=('any')
    
      8url="https://com-lihaoyi.github.io/mill/"
    
      9license=('MIT')
    
      10depends=('bash' 'java-environment')
    
      11
    
      12source=("mill-binary::https://repo1.maven.org/maven2/com/lihaoyi/mill-dist/$pkgver/mill-dist-$pkgver-mill.sh")
    
      13sha512sums=('22feb95954a2b4d06642d92cdb775b9aeeaa7d52e8e425344727a2efaa5c732cdcf31b39eedadebf0b089a1c3c060076d6605214d9c11d19b05ef04d7e01e447')
    
      14
    
      15prepare() {
    
      16  chmod +x "$srcdir/mill-binary"
    
      17}
    
      18
    
      19package() {
    
      20  install -Dm755 "$srcdir/mill-binary" "$pkgdir"/usr/bin/mill
    
      21}
    
      22

Changes since previous scan

--- PKGBUILD @ 2026-10-05 23:40
+++ PKGBUILD @ 2026-10-19 00:03
@@ -1,7 +1,7 @@
 # Maintainer: Andreas Wendleder <gonsolo@gmail.com>
 
 pkgname=mill
-pkgver=1.1.10
+pkgver=1.1.8
 pkgrel=1
 pkgdesc="A shiny new build tool for Java and Scala, designed for performance and reliability"
 arch=('any')
@@ -10,7 +10,7 @@
 depends=('bash' 'java-environment')
 
 source=("mill-binary::https://repo1.maven.org/maven2/com/lihaoyi/mill-dist/$pkgver/mill-dist-$pkgver-mill.sh")
-sha512sums=('b97aaf809e9681e221e52d2c9babc8b07b5de1e47bdd67cd972b99f13dd6dc27c94352867833a5914df8efbd08347f04e418d48e39f91bc72d3ffdc4d935165a')
+sha512sums=('22feb95954a2b4d06642d92cdb775b9aeeaa7d52e8e425344727a2efaa5c732cdcf31b39eedadebf0b089a1c3c060076d6605214d9c11d19b05ef04d7e01e447')
 
 prepare() {
   chmod +x "$srcdir/mill-binary"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 00:11:52	Low	2
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 00:13:36	Low	2
2026-10-05 23:40:58	Medium	1
2026-10-05 00:08:03	Low	2
2026-10-04 00:18:08	Low	2
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2