openvox-agent-bin

LOW

maintainer Lirion 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads prebuilt Debian packages from the project's own repository (apt.voxpupuli.org), which is plausibly official; the host is not whitelisted but belongs to the project, and the binaries are verified via b2sum, reducing supply-chain risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt Debian packages from the project's own repository (apt.voxpupuli.org), which is plausibly official; the host is not whitelisted but belongs to the project, and the binaries are verified via b2sum, reducing supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source_x86_64=("https://apt.voxpupuli.org/pool/openvox9/o/openvox-agent/${_pkgname}_${pkgver}-1+debian13_amd64.deb")

PKGBUILD

1 offending line(s) highlighted

      1pkgname=openvox-agent-bin
    
      2_pkgname=openvox-agent
    
      3pkgver=9.2.1
    
      4pkgrel=1
    
      5pkgdesc='Agent of the OpenVox Automation Framework (non-modular)'
    
      6arch=('x86_64' 'aarch64' 'armv7h')
    
      7url='https://voxpupuli.org/openvox/'
    
      8license=('Apache-2.0')
    
      9depends=('libxcrypt-compat')
    
      10options=('!debug')
    
      11conflicts=('puppet' 'openvox' 'openvox8-agent-bin')
    
      12provides=('puppet' 'openvox')
    
      13backup=('etc/puppetlabs/puppet/puppet.conf' 'etc/puppetlabs/puppet/hiera.yaml')
    
      14
    
      15source_x86_64=("https://apt.voxpupuli.org/pool/openvox9/o/openvox-agent/${_pkgname}_${pkgver}-1+debian13_amd64.deb")
    
      16source_aarch64=("https://apt.voxpupuli.org/pool/openvox9/o/openvox-agent/${_pkgname}_${pkgver}-1+debian13_arm64.deb")
    
      17source_armv7h=("https://apt.voxpupuli.org/pool/openvox9/o/openvox-agent/${_pkgname}_${pkgver}-1+debian13_armhf.deb")
    
      18
    
      19prepare() {
    
      20    mkdir -p data
    
      21    bsdtar -x -f data.tar.gz -C data
    
      22}
    
      23
    
      24package() {
    
      25    cp -a  "${srcdir}/data/opt" "${pkgdir}/"
    
      26    cp -a  "${srcdir}/data/etc" "${pkgdir}/"
    
      27    install -Dm 644 "${srcdir}/data/lib/systemd/system/puppet.service" "${pkgdir}/usr/lib/systemd/system/puppet.service"
    
      28}
    
      29b2sums_x86_64=('5b52adb2cb1cbab1e6d0e73a1e7312fd0948afd184bb80a3df95a0e5ef68c087218cdd7dafca0f113811fe8292a64d57999ab3fb67dbac1039981cc1ae397827')
    
      30b2sums_aarch64=('936745a814e1d0dbd71fd18c3fa4132a164f8faff1dcade3888e3c6a8d95b46b46312f8e2afa9a8413f69012ba725eacd327fbe97bc2e3f9190368d5e2fc8e6a')
    
      31b2sums_armv7h=('8955d20c490edab64de82da62ae65ee552fec44e8ef8822ad03b67e7c481e0d3c38ab9db5e9984589dddbef99a2cbe3cc5e810554e5ba6ee8bfc41e0e654dd94')
    
      32

Changes since previous scan

--- PKGBUILD @ 2026-10-25 07:42
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,6 +1,6 @@
 pkgname=openvox-agent-bin
 _pkgname=openvox-agent
-pkgver=9.2.0
+pkgver=9.2.1
 pkgrel=1
 pkgdesc='Agent of the OpenVox Automation Framework (non-modular)'
 arch=('x86_64' 'aarch64' 'armv7h')
@@ -26,7 +26,7 @@
     cp -a  "${srcdir}/data/etc" "${pkgdir}/"
     install -Dm 644 "${srcdir}/data/lib/systemd/system/puppet.service" "${pkgdir}/usr/lib/systemd/system/puppet.service"
 }
-b2sums_x86_64=('596190e1212b531b3b9680d09f9c1e92b5a7091a3986b7fadada13e0bf925b0139f3dda064c7b4bea3351884a039084e9d8ea3504ff727150984b1b0b227a109')
-b2sums_aarch64=('9bb3d7f35d0952760c6aeaae8801e1b672532e30e738a195e6dfce1607d81fc9e935a116bfc8d2a69fea32152bbea302009f48fa3431d646fcefa071f777b13e')
-b2sums_armv7h=('38b6871300a59b66c132d93bdda77cd6a3d403b73984b1aef4f23492dbcd10c4b55ffba42a90ded226b4cb22b8bcdde159fd3cecafca95b1af5c693d0ebd03d6')
+b2sums_x86_64=('5b52adb2cb1cbab1e6d0e73a1e7312fd0948afd184bb80a3df95a0e5ef68c087218cdd7dafca0f113811fe8292a64d57999ab3fb67dbac1039981cc1ae397827')
+b2sums_aarch64=('936745a814e1d0dbd71fd18c3fa4132a164f8faff1dcade3888e3c6a8d95b46b46312f8e2afa9a8413f69012ba725eacd327fbe97bc2e3f9190368d5e2fc8e6a')
+b2sums_armv7h=('8955d20c490edab64de82da62ae65ee552fec44e8ef8822ad03b67e7c481e0d3c38ab9db5e9984589dddbef99a2cbe3cc5e810554e5ba6ee8bfc41e0e654dd94')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 09:42:04	Medium	1
2026-10-25 07:42:02	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 01:20:44	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 11:18:02	Medium	2
2026-10-17 00:21:55	Low	2