pacdep

maintainer jjacky · 37 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is hosted on the maintainer's personal domain, which is not on a standard forge, but the package builds from a tarball of the project's own source code, which is a normal AUR practice; the worst case of a swapped source is limited to code execution during build, but given the simplicity of the build and the public project URL, the risk is low.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is hosted on the maintainer's personal domain, which is not on a standard forge, but the package builds from a tarball of the project's own source code, which is a normal AUR practice; the worst case of a swapped source is limited to code execution during build, but given the simplicity of the build and the public project URL, the risk is low.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=(https://jjacky.com/$pkgname/$pkgname-$pkgver.tar.gz)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: jjacky
    
      2pkgname=pacdep
    
      3pkgver=1.1.0
    
      4pkgrel=4
    
      5pkgdesc="Package Dependencies listing"
    
      6arch=('i686' 'x86_64')
    
      7url="https://jjacky.com/pacdep"
    
      8license=('GPL3+')
    
      9depends=('pacman')
    
      10makedepends=('perl' 'groff')
    
      11source=(https://jjacky.com/$pkgname/$pkgname-$pkgver.tar.gz)
    
      12md5sums=('4c416189360ad48320383a5720d51f19')
    
      13
    
      14build() {
    
      15  cd "$srcdir/$pkgname-$pkgver"
    
      16  ./configure --prefix=/usr
    
      17  make
    
      18}
    
      19
    
      20package() {
    
      21  cd "$srcdir/$pkgname-$pkgver"
    
      22  make DESTDIR="$pkgdir/" install
    
      23}
    
      24
    
      25# vim:set ts=2 sw=2 et:
    
      26

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2