mynewt-newt

maintainer Microwave_Chef · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from official source on GitHub, uses a verifiable checksum, and installs a binary built locally; the orphaned status is unrelated to security.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from official source on GitHub, uses a verifiable checksum, and installs a binary built locally; the orphaned status is unrelated to security.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Kyle Manna kyle[at]kylemanna[d0t]com
    
      2
    
      3pkgname=mynewt-newt
    
      4pkgver=1.15.0
    
      5_pkgver=${pkgver//./_}
    
      6pkgrel=1
    
      7epoch=
    
      8pkgdesc="A tool to use with the gx package manager for packages written in go."
    
      9arch=('x86_64')
    
      10url="https://github.com/apache/mynewt-newt"
    
      11license=('Apache')
    
      12depends=()
    
      13makedepends=('go')
    
      14source=("https://github.com/apache/mynewt-newt/archive/mynewt_${_pkgver}_tag.tar.gz")
    
      15sha512sums=('c184ae89dd54a698a94eb0809a1a7d65e0544053a86cedaffb37e5b5912999c956ac6759bc9ae0106f26249c038329a1aa4628c773d307fae11bac5d527b114d')
    
      16
    
      17build() {
    
      18	cd "${srcdir}/mynewt-newt-mynewt_${_pkgver}_tag"
    
      19
    
      20    msg2 'Building binary...'
    
      21	./build.sh
    
      22}
    
      23
    
      24package() {
    
      25	cd "${srcdir}/mynewt-newt-mynewt_${_pkgver}_tag"
    
      26
    
      27    msg2 'Packaging binary...'
    
      28    install -Dm 755 newt/newt "${pkgdir}/usr/bin/newt"
    
      29}
    
      30

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: Kyle Manna kyle[at]kylemanna[d0t]com
 
 pkgname=mynewt-newt
-pkgver=1.10.0
+pkgver=1.15.0
 _pkgver=${pkgver//./_}
 pkgrel=1
 epoch=
@@ -12,7 +12,7 @@
 depends=()
 makedepends=('go')
 source=("https://github.com/apache/mynewt-newt/archive/mynewt_${_pkgver}_tag.tar.gz")
-sha512sums=('6109b0421d8e02d5b83082f8085ccf0904ad7f1997e1d9932fad015d3cb40ab6804571a2466d2a42f3f7970e114ac25b2a9084c3c15e16c46eb01f359ecc0151')
+sha512sums=('c184ae89dd54a698a94eb0809a1a7d65e0544053a86cedaffb37e5b5912999c956ac6759bc9ae0106f26249c038329a1aa4628c773d307fae11bac5d527b114d')
 
 build() {
 	cd "${srcdir}/mynewt-newt-mynewt_${_pkgver}_tag"
@@ -28,4 +28,3 @@
     install -Dm 755 newt/newt "${pkgdir}/usr/bin/newt"
 }
 
-

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 03:31:41	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0