openssh-known-hosts

maintainer another · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a tarball from the project's own Git server (git.tiwe.de), which is plausibly the official project host; the package builds from source and installs only scripts and data files, with no evidence of remote code execution or malicious payload.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the project's own Git server (git.tiwe.de), which is plausibly the official project host; the package builds from source and installs only scripts and data files, with no evidence of remote code execution or malicious payload.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("https://git.tiwe.de/openssh-known-hosts.git/snapshot/${pkgname}-${pkgver}.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: another <code § deadcode § eu>
    
      2pkgname=openssh-known-hosts
    
      3pkgver=0.6.2
    
      4pkgrel=3
    
      5pkgdesc="known_hosts downloader/merger for OpenSSH"
    
      6arch=('any')
    
      7url="https://git.tiwe.de/openssh-known-hosts.git"
    
      8license=('GPL3')
    
      9depends=('bash' 'lockfile-progs')
    
      10optdepends=('cron: periodic execution'
    
      11			'openssh: connect to remote servers'
    
      12			'curl: retrieve known_hosts via HTTP, FTP, etc.'
    
      13			'rsync: retrieve known_hosts via rsync'
    
      14			'postgresql-client: retrieve known_hosts from PostgreSQL'
    
      15			'gnupg: verify signed files')
    
      16install=openssh-known-hosts.install
    
      17source=("https://git.tiwe.de/openssh-known-hosts.git/snapshot/${pkgname}-${pkgver}.tar.gz"
    
      18		"update-openssh-known-hosts.8"
    
      19		"openssh-known-hosts.cron.d")
    
      20sha256sums=('2d1cbb0c206cddf514304fb9e6a132497e1aa2e20da6eaf53ca3a02584ef9d30'
    
      21            '3b1e5b3c889ad550a233814a14461ce6bbf33e858fca55761ffb69e0c28c317e'
    
      22            'c6f1e2c22664b102710eb21aec306b6e73b3caf88e3c870b1e3ffc496d0e406d')
    
      23sha512sums=('90ed8bf3068590b5fab3dcfcb3e001b149660e1c4875d3fc87ba764334ac758be99b80dcbe6f8715389f374228e7d09f1de9125db5001356105dc48abf595ae0'
    
      24            '7ca4360231ea3e6b7e19aa2aac576acb112c5a6b54ed675034f1ba3de378805842478d7001da3342dd97b0d64d842576f14d3ea522a0480468d370d69b5c1f14'
    
      25            '64da7c4baa16eb9d41a143aca5a47380afc85c9faf25eb17ff5ccdbd7b02500d5dbb527cdbcd62829a729a9833a0c66977e03532f71a43e91ba8b42c61fe0a99')
    
      26
    
      27package() {
    
      28	install -Dm0644 update-openssh-known-hosts.8 $pkgdir/usr/share/man/man8/update-openssh-known-hosts.8
    
      29	install -Dm0644 openssh-known-hosts.cron.d $pkgdir/etc/cron.d/$pkgname
    
      30
    
      31	cd "$srcdir/${pkgname}-${pkgver}"
    
      32	install -Dm0755 update-openssh-known-hosts $pkgdir/usr/bin/update-openssh-known-hosts
    
      33	install -dm0755 $pkgdir/usr/share/$pkgname/plugins
    
      34	install -Dm0755 plugins/* $pkgdir/usr/share/$pkgname/plugins/
    
      35	install -dm0755 $pkgdir/usr/share/doc/$pkgname/examples
    
      36	install -Dm0644 examples/* $pkgdir/usr/share/doc/$pkgname/examples/
    
      37	install -Dm0644 changelog $pkgdir/usr/share/doc/$pkgname/changelog
    
      38	install -dm0755 $pkgdir/var/{lib,cache}/$pkgname $pkgdir/etc/$pkgname/sources $pkgdir/usr/share/$pkgname/plugins
    
      39	install -dm0755 $pkgdir/etc/ssh
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2