openvox8-agent-bin

LOW

maintainer Lirion 0 votes scanned 2026-10-18 01:22:35.611534

View on AUR

Why flagged

Prebuilt .deb binaries downloaded from apt.voxpupuli.org, which is the official Vox Pupuli (OpenVox) package repository, with b2sums provided for verification; the host is plausibly the project's own official infrastructure, making this a normal binary repackaging rather than a supply-chain risk, though the package is new/low-votes and the checksums should be independently verified.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Prebuilt .deb binaries downloaded from apt.voxpupuli.org, which is the official Vox Pupuli (OpenVox) package repository, with b2sums provided for verification; the host is plausibly the project's own official infrastructure, making this a normal binary repackaging rather than a supply-chain risk, though the package is new/low-votes and the checksums should be independently verified.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source_x86_64=("https://apt.voxpupuli.org/pool/openvox8/o/openvox-agent/${_pkgname}_${pkgver}-1+debian13_amd64.deb")

PKGBUILD

1 offending line(s) highlighted

      1pkgname=openvox8-agent-bin
    
      2_pkgname=openvox8-agent-bin
    
      3pkgver=8.31.0
    
      4pkgrel=2
    
      5pkgdesc='Agent of the OpenVox Automation Framework (non-modular)'
    
      6arch=('x86_64' 'aarch64' 'armv7h')
    
      7url='https://voxpupuli.org/openvox/'
    
      8license=('Apache-2.0')
    
      9depends=('libxcrypt-compat')
    
      10options=('!debug')
    
      11conflicts=('puppet' 'openvox' 'openvox-agent-bin')
    
      12provides=('puppet' 'openvox' 'openvox-agent-bin')
    
      13backup=('etc/puppetlabs/puppet/puppet.conf' 'etc/puppetlabs/puppet/hiera.yaml')
    
      14
    
      15source_x86_64=("https://apt.voxpupuli.org/pool/openvox8/o/openvox-agent/${_pkgname}_${pkgver}-1+debian13_amd64.deb")
    
      16source_aarch64=("https://apt.voxpupuli.org/pool/openvox8/o/openvox-agent/${_pkgname}_${pkgver}-1+debian13_arm64.deb")
    
      17source_armv7h=("https://apt.voxpupuli.org/pool/openvox8/o/openvox-agent/${_pkgname}_${pkgver}-1+debian13_armhf.deb")
    
      18
    
      19prepare() {
    
      20    mkdir -p data
    
      21    bsdtar -x -f data.tar.gz -C data
    
      22}
    
      23
    
      24package() {
    
      25    cp -a  "${srcdir}/data/opt" "${pkgdir}/"
    
      26    cp -a  "${srcdir}/data/etc" "${pkgdir}/"
    
      27    install -Dm 644 "${srcdir}/data/lib/systemd/system/puppet.service" "${pkgdir}/usr/lib/systemd/system/puppet.service"
    
      28}
    
      29b2sums_x86_64=('ce53f442cadebd033d91dbe20534c53074e1e1245551849c195052b8c6ee4bbdeb7bdb4d153928ef84b7f67c6104ecec4c1bdef4722555fe09f009faad71ae35')
    
      30b2sums_aarch64=('450b2436acab59528d7d5a6c986a92e6f0307ecd495ad4908e19e9fe1a9e8cf2e4880ef0cba968e78dd39f28e71ecfe29dcaf1ca08cd5e01813d9d32b6c9e526')
    
      31b2sums_armv7h=('67dfad036cdd2a75710abd6ff13d967ebab43ecf9f18a340797fd06d1f7cd70ef2fb264a627609600aa54ceacd262e9b6bdf119b9c2a49208149ade134b730ec')
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-18 01:22:35	Low	3
2026-10-18 01:20:44	Medium	3