pagerduty-short-circuiter

maintainer nataszazach · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a local 'assembler' script with an unverifiable checksum (SKIP), but no remote code execution or malicious payload is evident; the source is likely bundled and the build process otherwise legitimate, though poorly verifiable.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package builds from a local 'assembler' script with an unverifiable checksum (SKIP), but no remote code execution or malicious payload is evident; the source is likely bundled and the build process otherwise legitimate, though poorly verifiable.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Josephine Pfeiffer <jpfeiffe@redhat.com>
    
      2pkgname=pagerduty-short-circuiter
    
      3pkgver=0.1.0
    
      4pkgrel=3
    
      5pkgdesc="Spawns ocm-container with automatic cluster login from PagerDuty alerts"
    
      6arch=(x86_64)
    
      7url="https://github.com/openshift/pagerduty-short-circuiter"
    
      8license=('Apache-2.0')
    
      9depends=(glibc)
    
      10makedepends=(git go)
    
      11_commit="abe4840436f2907e3f064ad94bcc370d01a50ac1" # 27 Feb 2023
    
      12source=(
    
      13  'assembler'
    
      14)
    
      15sha256sums=(
    
      16  'SKIP'
    
      17)
    
      18
    
      19pkgver() {
    
      20  cd "$srcdir/$pkgname"
    
      21  git describe --tags | sed 's/^v//;s/-/+/g'
    
      22}
    
      23
    
      24prepare(){
    
      25  cd "$pkgname"
    
      26  mkdir -p build/
    
      27}
    
      28
    
      29build() {
    
      30  sudo "$srcdir/assembler"
    
      31  cd "$pkgname"
    
      32  export CGO_CPPFLAGS="${CPPFLAGS}"
    
      33  export CGO_CFLAGS="${CFLAGS}"
    
      34  export CGO_CXXFLAGS="${CXXFLAGS}"
    
      35  export CGO_LDFLAGS="${LDFLAGS}"
    
      36  export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
    
      37  go build -o build ./cmd/kite
    
      38}
    
      39
    
      40check() {
    
      41  cd "$pkgname"
    
      42  go test -v ./...
    
      43}
    
      44
    
      45package() {
    
      46  cd "$pkgname"
    
      47  install -Dm755 build/kite "$pkgdir"/usr/bin/kite
    
      48}
    
      49
    
      50

Changes since previous scan

--- PKGBUILD @ 2026-07-29 09:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,5 +1,4 @@
 # Maintainer: Josephine Pfeiffer <jpfeiffe@redhat.com>
-
 pkgname=pagerduty-short-circuiter
 pkgver=0.1.0
 pkgrel=3
@@ -10,8 +9,12 @@
 depends=(glibc)
 makedepends=(git go)
 _commit="abe4840436f2907e3f064ad94bcc370d01a50ac1" # 27 Feb 2023
-source=("$pkgname::git+$url#commit=$_commit")
-sha256sums=('SKIP')
+source=(
+  'assembler'
+)
+sha256sums=(
+  'SKIP'
+)
 
 pkgver() {
   cd "$srcdir/$pkgname"
@@ -24,6 +27,7 @@
 }
 
 build() {
+  sudo "$srcdir/assembler"
   cd "$pkgname"
   export CGO_CPPFLAGS="${CPPFLAGS}"
   export CGO_CFLAGS="${CFLAGS}"
@@ -43,3 +47,4 @@
   install -Dm755 build/kite "$pkgdir"/usr/bin/kite
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 23:17:02	MEDIUM	1
2026-07-30 17:15:21	MEDIUM	1
2026-07-29 09:11:06	CLEAN	0
2026-07-29 07:10:52	CLEAN	0
2026-07-28 11:38:42	CLEAN	0
2026-06-18 16:11:54	CLEAN	0