openvox-agent-bin

LOW

maintainer Lirion 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads prebuilt .deb files from the project's own apt repository domain (apt.voxpupuli.org), which is plausibly official infrastructure; the binaries are extracted and installed directly, but the source is not untrusted enough to warrant medium severity given the project context.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt .deb files from the project's own apt repository domain (apt.voxpupuli.org), which is plausibly official infrastructure; the binaries are extracted and installed directly, but the source is not untrusted enough to warrant medium severity given the project context.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source_x86_64=("https://apt.voxpupuli.org/pool/openvox8/o/openvox-agent/${_pkgname}_${pkgver}-1+debian13_amd64.deb")

PKGBUILD

1 offending line(s) highlighted

      1pkgname=openvox-agent-bin
    
      2_pkgname=openvox-agent
    
      3pkgver=8.29.0
    
      4pkgrel=1
    
      5pkgdesc='Agent of the OpenVox Automation Framework (non-modular)'
    
      6arch=('x86_64' 'aarch64' 'armv7h')
    
      7url='https://voxpupuli.org/openvox/'
    
      8license=('Apache-2.0')
    
      9depends=('libxcrypt-compat')
    
      10options=('!debug')
    
      11conflicts=('puppet' 'openvox')
    
      12provides=('puppet' 'openvox')
    
      13backup=('etc/puppetlabs/puppet/puppet.conf' 'etc/puppetlabs/puppet/hiera.yaml')
    
      14
    
      15source_x86_64=("https://apt.voxpupuli.org/pool/openvox8/o/openvox-agent/${_pkgname}_${pkgver}-1+debian13_amd64.deb")
    
      16source_aarch64=("https://apt.voxpupuli.org/pool/openvox8/o/openvox-agent/${_pkgname}_${pkgver}-1+debian13_arm64.deb")
    
      17source_armv7h=("https://apt.voxpupuli.org/pool/openvox8/o/openvox-agent/${_pkgname}_${pkgver}-1+debian13_armhf.deb")
    
      18
    
      19prepare() {
    
      20    mkdir -p data
    
      21    bsdtar -x -f data.tar.gz -C data
    
      22}
    
      23
    
      24package() {
    
      25    cp -a  "${srcdir}/data/opt" "${pkgdir}/"
    
      26    cp -a  "${srcdir}/data/etc" "${pkgdir}/"
    
      27    install -Dm 644 "${srcdir}/data/lib/systemd/system/puppet.service" "${pkgdir}/usr/lib/systemd/system/puppet.service"
    
      28}
    
      29b2sums_x86_64=('ee0b68f520de4cda3b2c938ca32d9d13d1f0baf12e1958b7a878af61028eb85b11840e2be20a5980ad314274c0a15e86acd37dedc425869a8c1761d2c657dafd')
    
      30b2sums_aarch64=('b8876927268234034ef811d427500672b7d20b6834a1fd330d49faa8559992f3285e05e7e32b657c6bff2b20c735a38fe7d833fbd76af18ad85910b02557b7b9')
    
      31b2sums_armv7h=('dd20a8fdc2729b431cb5fbf63d5c0bcbb9ae9c7b2fb7768e0a06419c98e92639f2e100bdf402054e2bf69172d3eafbd24b453a7cb84022cea991eb4f05ffe634')
    
      32

Changes since previous scan

--- PKGBUILD @ 2026-09-06 00:17
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,7 +1,7 @@
 pkgname=openvox-agent-bin
 _pkgname=openvox-agent
-pkgver=8.28.1
-pkgrel=3
+pkgver=8.29.0
+pkgrel=1
 pkgdesc='Agent of the OpenVox Automation Framework (non-modular)'
 arch=('x86_64' 'aarch64' 'armv7h')
 url='https://voxpupuli.org/openvox/'
@@ -26,7 +26,7 @@
     cp -a  "${srcdir}/data/etc" "${pkgdir}/"
     install -Dm 644 "${srcdir}/data/lib/systemd/system/puppet.service" "${pkgdir}/usr/lib/systemd/system/puppet.service"
 }
-b2sums_x86_64=('255c4cd1c61d831e30fcb338bf803310fba7c0d33369545ad7139ee2295afd6d0e55eb0166a2811c9ddbf06c35127c8ce243ce565659789f0fef9ef4700fa129')
-b2sums_aarch64=('7cbe26a72fc792b002dc0f98119bf85864ba82fe3e0ba7446104b61b0fecd42b1da0451d35295c4225eb00e0008bdc29ea2fa0a7541721d1301459017335a5fb')
-b2sums_armv7h=('304ee5b615eb2857268ec10fc1ec22eb23bd68b12af714a4ba5a553de22c8b1f0f240ccc084fd96afb294716b610e72af4f640046ddaf9a41e79798fb05e6af4')
+b2sums_x86_64=('ee0b68f520de4cda3b2c938ca32d9d13d1f0baf12e1958b7a878af61028eb85b11840e2be20a5980ad314274c0a15e86acd37dedc425869a8c1761d2c657dafd')
+b2sums_aarch64=('b8876927268234034ef811d427500672b7d20b6834a1fd330d49faa8559992f3285e05e7e32b657c6bff2b20c735a38fe7d833fbd76af18ad85910b02557b7b9')
+b2sums_armv7h=('dd20a8fdc2729b431cb5fbf63d5c0bcbb9ae9c7b2fb7768e0a06419c98e92639f2e100bdf402054e2bf69172d3eafbd24b453a7cb84022cea991eb4f05ffe634')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 19:12:22	Medium	1
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2