open-vault

maintainer pbazaah · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a tarball from a personal host but contains the project's own source code that is built locally; the worst case of a swapped source is building malicious code, but this is a common AUR pattern with low immediate risk given the build-from-source approach and no evidence of obfuscation or remote code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from a personal host but contains the project's own source code that is built locally; the worst case of a swapped source is building malicious code, but this is a common AUR pattern with low immediate risk given the build-from-source approach and no evidence of obfuscation or remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("${pkgname}-${pkgver}.tar.gz::https://git.st8l.com/luxolus/${pkgname}/archive/${_commit}.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Paul Stemmet <aur@luxolus.com>
    
      2# Contributor: Christian Rebischke <Chris.Rebischke@archlinux.org>
    
      3# Contributor: Justin Kromlinger <hashworks@archlinux.org>
    
      4# Contributor: Tim Meusel <tim@bastelfreak.de>
    
      5# Contributor: Sebastian Rakel <sebastian@devunit.eu>
    
      6# Contributor: Andrew Tyler <assimilat@gmail.com>
    
      7
    
      8pkgname=open-vault
    
      9_commit='9f12e0f892b27c5518a918b15c46133cfdd2dff5'
    
      10pkgver=1.14.8
    
      11pkgrel=1
    
      12pkgdesc='A tool for managing secrets'
    
      13provides=('vault')
    
      14conflicts=('vault')
    
      15arch=('x86_64')
    
      16url="https://developer.hashicorp.com/vault/docs/v1.14.x"
    
      17license=('MPL2')
    
      18depends=('glibc')
    
      19makedepends=('go' 'git' 'yarn' 'bower' 'nodejs-lts-iron' 'npm' 'zip')
    
      20install=vault.install
    
      21backup=('etc/vault.hcl' 'etc/default/vault')
    
      22source=("${pkgname}-${pkgver}.tar.gz::https://git.st8l.com/luxolus/${pkgname}/archive/${_commit}.tar.gz"
    
      23        'vault.sysusers'
    
      24        'vault.tmpfiles'
    
      25        'vault.hcl')
    
      26sha512sums=('SKIP'
    
      27            '92616ccf83fa5ca9f8b0d022cf8ceb1f3549e12b66bf21d9f77f3eb26bd75ec1dc36c155948ec987c642067b85fbfc30a9217d6c503d952a402aa5ef63e50928'
    
      28            'db327aae6f821ee1ea608abdb3fc82aeeae72ce873d78ada44461644add32afd6c0197019427734498bc28ae187b6f741a02196e40a620caab597e5eef32ca7a'
    
      29            '75d654ec4eadfe983f57951d470fff8b9eb953b42c08e7b6b3a1baaa0721fd7a9d5be37480b0e4f4fd8518f375348bdd8394848f0fb27cb1d425279acb67f693')
    
      30
    
      31export CGO_CPPFLAGS="${CPPFLAGS}"
    
      32export CGO_CFLAGS="${CFLAGS}"
    
      33export CGO_CXXFLAGS="${CXXFLAGS}"
    
      34export CGO_LDFLAGS="${LDFLAGS}"
    
      35
    
      36export GOFLAGS="-buildmode=pie -trimpath -mod=readonly -modcacherw"
    
      37
    
      38prepare() {
    
      39  cd "${srcdir}/${pkgname}"
    
      40
    
      41  mkdir -p http/web_ui bin dist
    
      42
    
      43  local filename
    
      44  for filename in "${source[@]}"; do
    
      45    if [[ "$filename" =~ \.patch$ ]]; then
    
      46      patch -p1 -N -l -i "$srcdir/${filename##*/}"
    
      47    fi
    
      48  done
    
      49
    
      50  sed -i \
    
      51    's|/etc/vault.d/vault.hcl|/etc/vault.hcl|g' \
    
      52    .release/linux/package/usr/lib/systemd/system/vault.service
    
      53  sed -i \
    
      54    's|/etc/vault.d/vault.env|/etc/default/vault|g' \
    
      55    .release/linux/package/usr/lib/systemd/system/vault.service
    
      56
    
      57  # Vault UI
    
      58  (
    
      59    cd "ui"
    
      60
    
      61    yarn install
    
      62  )
    
      63
    
      64  # Vault service
    
      65  (
    
      66    go mod download
    
      67  )
    
      68}
    
      69
    
      70build() {
    
      71  cd "${srcdir}/${pkgname}"
    
      72
    
      73  # Vault UI
    
      74  (
    
      75    cd "ui"
    
      76
    
      77    npm rebuild node-sass ; yarn run build
    
      78  )
    
      79
    
      80  # Vault service
    
      81  (
    
      82    local _flags=github.com/hashicorp/vault/sdk/version
    
      83    local _ldflags=(
    
      84      "-linkmode=external"
    
      85      "-compressdwarf=false"
    
      86      $(
    
      87        printf -- "-X ${_flags}.%s " \
    
      88          "Version=${pkgver}" \
    
      89          "GitCommit=${_commit}" \
    
      90          "BuildDate=$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
    
      91      )
    
      92    )
    
      93
    
      94    go build -tags ui -ldflags "${_ldflags[*]}" -o dist .
    
      95  )
    
      96}
    
      97
    
      98package() {
    
      99  cd "${srcdir}/${pkgname}"
    
      100
    
      101  local file release='.release/linux/package'
    
      102
    
      103  # configuration
    
      104  install -Dm644 "${srcdir}/vault.hcl"                "${pkgdir}/etc/vault.hcl"
    
      105  install -Dm644 "${srcdir}/vault.sysusers"           "${pkgdir}/usr/lib/sysusers.d/vault.conf"
    
      106  install -Dm644 "${srcdir}/vault.tmpfiles"           "${pkgdir}/usr/lib/tmpfiles.d/vault.conf"
    
      107  install -Dm644 \
    
      108    "$release/etc/vault.d/vault.env"                  "${pkgdir}/etc/default/vault"
    
      109  install -Dm644 \
    
      110    "$release/usr/lib/systemd/system/vault.service"   "${pkgdir}/usr/lib/systemd/system/vault.service"
    
      111
    
      112  install -Dm644 "LICENSE"                            "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      113
    
      114  for file in 'README.md' 'CHANGELOG.md'; do
    
      115    install -Dm644 "${file}"                          "${pkgdir}/usr/share/doc/${pkgname}/${file}"
    
      116  done
    
      117
    
      118  # binaries
    
      119  install -Dm755 "dist/vault"                         "${pkgdir}/usr/bin/vault"
    
      120}
    
      121

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2