onionspray
LOW
maintainer nihalxkumar
1 votes
scanned 2026-11-03 00:01:00.954084
Why flagged
The source is fetched from the official Tor Project GitLab instance, which is the legitimate and expected host for this project; building from a non-whitelisted but project-owned forge is normal for AUR packages and does not constitute a supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is fetched from the official Tor Project GitLab instance, which is the legitimate and expected host for this project; building from a non-whitelisted but project-owned forge is normal for AUR packages and does not constitute a supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:18
source=("git+https://gitlab.torproject.org/tpo/onion-services/onionspray.git#tag=v$pkgver")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Nihal Kumar <2tv8xupqg at mozmail dot com>
2
# https://github.com/nihalxkumar/PKGBUILDs/tree/main/onionspray
3
pkgname=onionspray
4
pkgver=1.8.5
5
pkgrel=1
6
pkgdesc="A tool to setup Onion Services for existing websites."
7
arch=('any')
8
url="https://gitlab.torproject.org/tpo/onion-services/onionspray"
9
license=('GPL-3.0-or-later')
10
depends=('perl' 'bash' 'tor' 'openbsd-netcat' 'rsync' 'openssl')
11
makedepends=('git')
12
optdepends=(
13
'onionbalance: for load balancing onion services'
14
'python: for validate-onion-key helper script'
15
'ruby: for onion-csr helper script'
16
'mkcert: for generating local CA certificates for TLS'
17
)
18
source=("git+https://gitlab.torproject.org/tpo/onion-services/onionspray.git#tag=v$pkgver")
19
sha256sums=('SKIP')
20
21
prepare() {
22
cd "$srcdir/$pkgname"
23
# Prevent failure when non-root users run onionspray commands (e.g. onionspray --help)
24
sed -i 's/chmod 700 \$secrets_dir || exit 1/chmod 700 \$secrets_dir 2>\/dev\/null || true/' onionspray
25
# Fetch submodules here so build() stays offline and reproducible
26
git submodule update --init --recursive
27
}
28
29
build() {
30
cd "$srcdir/$pkgname"
31
:
32
}
33
34
package() {
35
cd "$srcdir/$pkgname"
36
37
# Install to /opt/onionspray since it expects to be in a directory structure
38
install -dm755 "$pkgdir/opt/onionspray"
39
40
# Copy entire directory structure
41
cp -r --preserve=mode . "$pkgdir/opt/onionspray/" 2>/dev/null || true
42
43
# Preserve .git directory for git operations
44
# (needed by onionspray scripts)
45
46
# Ensure executable scripts have proper execute permissions
47
chmod 755 "$pkgdir/opt/onionspray/onionspray" 2>/dev/null || true
48
find "$pkgdir/opt/onionspray" -name "*.sh" -exec chmod 755 {} \;
49
find "$pkgdir/opt/onionspray" -name "*.pl" -exec chmod 755 {} \;
50
find "$pkgdir/opt/onionspray/lib" -type f \( -name "*.sh" -o -name "*.pl" -o -name "*.py" \) -exec chmod 755 {} 2>/dev/null \; || true
51
chmod 755 "$pkgdir/opt/onionspray/vendors/onionmine/onionmine" 2>/dev/null || true
52
chmod 755 "$pkgdir/opt/onionspray/vendors/onionmine/bin/"* 2>/dev/null || true
53
54
# Create necessary directories with proper permissions
55
install -dm700 "$pkgdir/opt/onionspray/secrets"
56
install -dm700 "$pkgdir/opt/onionspray/projects"
57
install -dm755 "$pkgdir/opt/onionspray/onionbalance"
58
59
# Create wrapper script in /usr/bin (intercept self-update commands)
60
install -dm755 "$pkgdir/usr/bin"
61
cat >"$pkgdir/usr/bin/onionspray" <<'EOF'
62
#!/bin/sh
63
if [ "$1" = "update" ] || [ "$1" = "upgrade" ]; then
64
echo "error: 'onionspray $1' is disabled for package-managed installations." >&2
65
echo "Please update via: sudo pacman -Syu onionspray" >&2
66
exit 1
67
fi
68
exec /opt/onionspray/onionspray "$@"
69
EOF
70
chmod 755 "$pkgdir/usr/bin/onionspray"
71
72
# Install documentation
73
install -dm755 "$pkgdir/usr/share/doc/$pkgname"
74
install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/" 2>/dev/null || true
75
install -Dm644 ChangeLog.md "$pkgdir/usr/share/doc/$pkgname/" 2>/dev/null || true
76
77
# Install license
78
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
79
}
80
Changes since previous scan
--- PKGBUILD @ 2026-10-10 00:11+++ PKGBUILD @ 2026-11-03 00:01@@ -1,7 +1,7 @@ # Maintainer: Nihal Kumar <2tv8xupqg at mozmail dot com> # https://github.com/nihalxkumar/PKGBUILDs/tree/main/onionspray pkgname=onionspray-pkgver=1.8.4+pkgver=1.8.5 pkgrel=1 pkgdesc="A tool to setup Onion Services for existing websites." arch=('any')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-03 00:01:00 | Low | 2 |
| 2026-11-02 00:26:00 | Low | 2 |
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 17:56:37 | Medium | 1 |
| 2026-10-10 00:11:52 | Clean | 2 |
| 2026-10-09 18:12:17 | Medium | 1 |
| 2026-10-09 00:05:33 | Low | 2 |
| 2026-10-08 00:28:03 | Low | 2 |
| 2026-10-07 00:21:34 | Low | 2 |
| 2026-10-06 00:13:36 | Low | 2 |
| 2026-10-05 00:08:03 | Low | 2 |
| 2026-10-04 00:18:08 | Low | 2 |
| 2026-10-03 00:23:04 | Low | 2 |
| 2026-10-02 00:00:32 | Low | 2 |
| 2026-10-01 00:02:06 | Low | 2 |
| 2026-09-30 00:20:07 | Low | 2 |
| 2026-09-29 00:07:46 | Low | 2 |
| 2026-09-28 00:28:32 | Low | 2 |
| 2026-09-27 00:07:07 | Low | 2 |