openvpn-auth-oauth2
LOW
maintainer k0ste
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The source is downloaded from GitHub's official codeload domain, which is a standard and trusted host for GitHub repositories, despite the non-whitelisted appearance; the package builds from verifiable source code with a valid checksum, posing no inherent risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is downloaded from GitHub's official codeload domain, which is a standard and trusted host for GitHub repositories, despite the non-whitelisted appearance; the package builds from verifiable source code with a valid checksum, posing no inherent risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:14
source=("${pkgname}-${pkgver}.tar.gz::https://codeload.${_uri}/${pkgname}/tar.gz/refs/tags/v${pkgver}")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Shalygin Konstantin <k0ste@k0ste.ru>
2
# Contributor: Shalygin Konstantin <k0ste@k0ste.ru>
3
4
pkgname='openvpn-auth-oauth2'
5
pkgver='2.2.0'
6
pkgrel='1'
7
pkgdesc='A Plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows'
8
arch=('x86_64' 'aarch64')
9
_uri="github.com/jkroepke"
10
url="https://${_uri}/${pkgname}"
11
license=('MIT')
12
makedepends=('go' 'git')
13
depends=('openvpn>=2.6.2')
14
source=("${pkgname}-${pkgver}.tar.gz::https://codeload.${_uri}/${pkgname}/tar.gz/refs/tags/v${pkgver}")
15
sha256sums=('9da34494c90fedcf257de922d9fa334a1d5d26bbf3fb65ac54005103b4bace82')
16
backup=("etc/conf.d/${pkgname}"
17
"etc/${pkgname}/config.yaml")
18
19
prepare() {
20
export GOPATH="${srcdir}/gopath"
21
export GOBIN="${GOPATH}/bin"
22
export GOTMPDIR="${GOPATH}/tmp"
23
export GOCACHE="${srcdir}/cache/go-cache"
24
export GOMODCACHE="${srcdir}/cache/go"
25
mkdir -p "${GOPATH}/src/${_uri}"
26
mkdir -p "${GOTMPDIR}"
27
eval "$(go env | grep -e "GOHOSTOS" -e "GOHOSTARCH")"
28
ln -snf "${srcdir}/${pkgname}-${pkgver}" "${GOPATH}/src/${_uri}/${pkgname}"
29
30
sed -i \
31
-e 's|/etc/sysconfig|/etc/conf.d|g' \
32
-e 's|CapabilityBoundingSet=|CapabilityBoundingSet=CAP_NET_BIND_SERVICE|g' \
33
-e 's|AmbientCapabilities=|AmbientCapabilities=CAP_NET_BIND_SERVICE|g' \
34
-e '/PrivateUsers=true/d' \
35
"${pkgname}-${pkgver}/packaging/usr/lib/systemd/system/${pkgname}.service"
36
37
}
38
39
build() {
40
cd "${GOPATH}/src/${_uri}/${pkgname}"
41
GOOS="${GOHOSTOS}" GOARCH="${GOHOSTARCH}" BUILDTAGS="no_otel"
42
43
for e in "cmd" "lib"
44
do
45
46
if [[ "${e}" == "lib" ]]
47
then
48
mode="c-shared"
49
outname="${pkgname}.so"
50
else
51
mode="pie"
52
outname="${pkgname}"
53
fi
54
55
go build \
56
-buildmode="${mode}" \
57
-trimpath \
58
-mod="readonly" \
59
-modcacherw \
60
-ldflags "-linkmode external -extldflags '${LDFLAGS}' \
61
-X ${_uri}/${pkgname}/internal/version.Version=${pkgver} \
62
-X ${_uri}/${pkgname}/internal/version.Commit=$(git rev-parse HEAD) \
63
-X ${_uri}/${pkgname}/internal/version.Date=$(date -u '+%Y%m%d-%H:%M:%S' --date=@${SOURCE_DATE_EPOCH})" \
64
-o "${outname}" \
65
"./${e}/${pkgname}"
66
done
67
}
68
69
check() {
70
cd "${GOPATH}/src/${_uri}/${pkgname}"
71
TMPDIR="${GOPATH}/tmp" go test -modcacherw -race ./...
72
}
73
74
package() {
75
cd "${pkgname}-${pkgver}"
76
install -Dm0644 "LICENSE.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
77
install -Dm0755 "${pkgname}" -t "${pkgdir}/usr/bin"
78
install -Dm0755 "${pkgname}.so" -t "${pkgdir}/usr/lib/openvpn/plugins"
79
install -Dm0644 "${pkgname}.h" -t "${pkgdir}/usr/include"
80
81
pushd "packaging"
82
install -Dm0644 "etc/${pkgname}/config.yaml" -t "${pkgdir}/etc/${pkgname}"
83
install -Dm0644 "etc/sysconfig/${pkgname}" -t "${pkgdir}/etc/conf.d"
84
install -Dm0644 "usr/lib/systemd/system/${pkgname}.service" -t "${pkgdir}/usr/lib/systemd/system"
85
install -Dm0644 "usr/lib/sysusers.d/${pkgname}.conf" -t "${pkgdir}/usr/lib/sysusers.d"
86
}
87
Changes since previous scan
--- PKGBUILD @ 2026-09-07 00:30+++ PKGBUILD @ 2026-09-17 00:27@@ -2,7 +2,7 @@ # Contributor: Shalygin Konstantin <k0ste@k0ste.ru> pkgname='openvpn-auth-oauth2'-pkgver='2.1.0'+pkgver='2.2.0' pkgrel='1' pkgdesc='A Plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows' arch=('x86_64' 'aarch64')@@ -12,7 +12,7 @@ makedepends=('go' 'git') depends=('openvpn>=2.6.2') source=("${pkgname}-${pkgver}.tar.gz::https://codeload.${_uri}/${pkgname}/tar.gz/refs/tags/v${pkgver}")-sha256sums=('62b83b4abd179fed22e9215ebec731ca3cca971c2fb23706470866fd9f78e9fd')+sha256sums=('9da34494c90fedcf257de922d9fa334a1d5d26bbf3fb65ac54005103b4bace82') backup=("etc/conf.d/${pkgname}" "etc/${pkgname}/config.yaml") Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 09:14:05 | Medium | 1 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |