nightingale-server-bin

MEDIUM

maintainer eggy 0 votes scanned 2026-09-05 03:59:20.365640

View on AUR

Why flagged

The package installs a prebuilt binary from GitHub releases without verifiable checksums (sha256sums set to SKIP), creating a supply-chain risk if the source is compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt binary from GitHub releases without verifiable checksums (sha256sums set to SKIP), creating a supply-chain risk if the source is compromised.

PKGBUILD

      1# Maintainer: eggy <d7chen@uwaterloo.ca>
    
      2
    
      3pkgname=nightingale-server-bin
    
      4pkgver=1.2.0
    
      5pkgrel=2
    
      6pkgdesc="Self-hosted Nightingale web server binary"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://github.com/rzru/nightingale"
    
      9license=('GPL-3.0-only')
    
      10backup=('etc/nightingale-server/env')
    
      11depends=(
    
      12  'glibc'
    
      13)
    
      14
    
      15optdepends=(
    
      16  'nginx: reverse proxy and TLS termination'
    
      17  'caddy: automatic HTTPS'
    
      18  'avahi: local network discovery'
    
      19)
    
      20
    
      21provides=('nightingale-server')
    
      22conflicts=('nightingale-server')
    
      23
    
      24install=nightingale-server.install
    
      25
    
      26source=(
    
      27  "nightingale-server.service"
    
      28  "nightingale-server.sysusers"
    
      29  "nightingale-server.tmpfiles"
    
      30  "nginx.conf.example"
    
      31)
    
      32
    
      33source_x86_64=(
    
      34  "nightingale-server-${pkgver}-x86_64.tar.gz::https://github.com/rzru/nightingale/releases/download/v${pkgver}/nightingale-server-x86_64-unknown-linux-gnu.tar.gz"
    
      35)
    
      36
    
      37source_aarch64=(
    
      38  "nightingale-server-${pkgver}-aarch64.tar.gz::https://github.com/rzru/nightingale/releases/download/v${pkgver}/nightingale-server-aarch64-unknown-linux-gnu.tar.gz"
    
      39)
    
      40
    
      41sha256sums=(
    
      42  'SKIP'
    
      43  'SKIP'
    
      44  'SKIP'
    
      45  'SKIP'
    
      46)
    
      47
    
      48sha256sums_x86_64=('SKIP')
    
      49sha256sums_aarch64=('SKIP')
    
      50
    
      51
    
      52package() {
    
      53    # Binary
    
      54    install -Dm755 \
    
      55        "${srcdir}/nightingale" \
    
      56        "${pkgdir}/usr/bin/nightingale-server"
    
      57
    
      58
    
      59    # systemd service
    
      60    install -Dm644 \
    
      61        "${srcdir}/nightingale-server.service" \
    
      62        "${pkgdir}/usr/lib/systemd/system/nightingale-server.service"
    
      63
    
      64
    
      65    # system user
    
      66    install -Dm644 \
    
      67        "${srcdir}/nightingale-server.sysusers" \
    
      68        "${pkgdir}/usr/lib/sysusers.d/nightingale-server.conf"
    
      69
    
      70
    
      71    # persistent directories
    
      72    install -Dm644 \
    
      73        "${srcdir}/nightingale-server.tmpfiles" \
    
      74        "${pkgdir}/usr/lib/tmpfiles.d/nightingale-server.conf"
    
      75
    
      76
    
      77    # nginx example
    
      78    install -Dm644 \
    
      79        "${srcdir}/nginx.conf.example" \
    
      80        "${pkgdir}/usr/share/doc/nightingale-server/nginx.conf.example"
    
      81}
    
      82

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-05 03:59:20	Medium	2