pds-gatekeeper-git

maintainer yuna0x0 · 1 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The source is a git repository hosted on a non-standard domain, but it is the project's own source being built from scratch; the worst case of a malicious swap would be code execution during build, which is contained within AUR packaging norms.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git repository hosted on a non-standard domain, but it is the project's own source being built from scratch; the worst case of a malicious swap would be code execution during build, which is contained within AUR packaging norms.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("git+https://tangled.org/did:plc:rnpkyqnmsw4ipey6eotbdnnf/pds-gatekeeper.git"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: yuna0x0 <yuna@yuna0x0.com>
    
      2
    
      3pkgname=pds-gatekeeper-git
    
      4pkgver=r28.eef639e
    
      5pkgrel=1
    
      6pkgdesc="Microservice to bring 2FA to self hosted AT Protocol PDSes"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://tangled.org/did:plc:rnpkyqnmsw4ipey6eotbdnnf/pds-gatekeeper"
    
      9license=('MIT')
    
      10depends=('gcc-libs' 'glibc' 'atproto-pds')
    
      11makedepends=('cargo' 'git')
    
      12options=('!lto') # LTO causes build failures for sqlx
    
      13provides=("${pkgname%-git}=$pkgver-$pkgrel")
    
      14conflicts=("${pkgname%-git}")
    
      15backup=('etc/pds-gatekeeper.env')
    
      16source=("git+https://tangled.org/did:plc:rnpkyqnmsw4ipey6eotbdnnf/pds-gatekeeper.git"
    
      17        'pds-gatekeeper.service'
    
      18        'pds-gatekeeper.tmpfiles'
    
      19        'pds-gatekeeper.env')
    
      20b2sums=('SKIP'
    
      21        'bc74db9db2f67fe1f2be78d39d1a6ff3cb3839036945648ec0fc3d85a015d1650086d053830199f1bd4df8257a466142771a213becf11eaadf1bd0424098ccb9'
    
      22        'b115bacdf53f3e21976d61972347316f671742efee9b88e121690579998c0b3ec5db313640f61dca735618151f0e3db6c2f62fa1291430dd6d88d3f6d8b204dc'
    
      23        'cf188c11ab976a7a54f77eab17cac6206ac95779429e227a44358249b33375e6e0e7f07bdbeb1f2579ce7f1120cc5158eb0e0dae8a82ed3167706dc86e4cea17')
    
      24
    
      25pkgver() {
    
      26  cd "$srcdir/pds-gatekeeper"
    
      27  ( set -o pipefail
    
      28    git describe --long --abbrev=7 2>/dev/null | sed 's/\([^-]*-g\)/r\1/;s/-/./g' ||
    
      29    printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      30  )
    
      31}
    
      32
    
      33prepare() {
    
      34  cd "$srcdir/pds-gatekeeper"
    
      35
    
      36  export RUSTUP_TOOLCHAIN=stable
    
      37  cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      38}
    
      39
    
      40build() {
    
      41  cd "$srcdir/pds-gatekeeper"
    
      42  export RUSTUP_TOOLCHAIN=stable
    
      43  export CARGO_TARGET_DIR=target
    
      44  cargo build --frozen --release --all-features
    
      45}
    
      46
    
      47check() {
    
      48  cd "$srcdir/pds-gatekeeper"
    
      49  export RUSTUP_TOOLCHAIN=stable
    
      50  cargo test --frozen --all-features
    
      51}
    
      52
    
      53package() {
    
      54  cd "$srcdir/pds-gatekeeper"
    
      55
    
      56  install -Dm0755 "target/release/pds_gatekeeper" "$pkgdir/usr/bin/pds-gatekeeper"
    
      57
    
      58  install -Dm0644 "$srcdir/pds-gatekeeper.service" "$pkgdir/usr/lib/systemd/system/pds-gatekeeper.service"
    
      59  install -Dm0644 "$srcdir/pds-gatekeeper.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/pds-gatekeeper.conf"
    
      60  install -Dm0644 "$srcdir/pds-gatekeeper.env" "$pkgdir/etc/pds-gatekeeper.env"
    
      61
    
      62  install -Dm0644 email_templates/* -t "$pkgdir/usr/share/pds-gatekeeper/email_templates"
    
      63
    
      64  install -Dm0644 LICENSE.md "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      65  install -Dm0644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      66}
    
      67

Changes since previous scan

--- PKGBUILD @ 2026-06-20 00:18
+++ PKGBUILD @ 2026-08-18 00:03
@@ -1,10 +1,10 @@
 # Maintainer: yuna0x0 <yuna@yuna0x0.com>
 
 pkgname=pds-gatekeeper-git
-pkgver=r27.9605d15
+pkgver=r28.eef639e
 pkgrel=1
 pkgdesc="Microservice to bring 2FA to self hosted AT Protocol PDSes"
-arch=('x86_64')
+arch=('x86_64' 'aarch64')
 url="https://tangled.org/did:plc:rnpkyqnmsw4ipey6eotbdnnf/pds-gatekeeper"
 license=('MIT')
 depends=('gcc-libs' 'glibc' 'atproto-pds')

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 00:17:07	LOW	2
2026-08-12 07:23:13	MEDIUM	1
2026-06-20 00:18:46	CLEAN	2
2026-06-19 23:51:18	MEDIUM	2
2026-06-19 19:07:35	LOW	2
2026-06-18 16:11:54	MEDIUM	1