perl-travel-status-de-efa-git
LOW
maintainer dreieck
0 votes
scanned 2026-10-21 00:12:50.227280
Why flagged
The package builds from source using git repositories hosted on the project's own domain and GitHub; the non-standard host is the project's official infrastructure, and no untrusted prebuilt binaries are executed.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source using git repositories hosted on the project's own domain and GitHub; the non-standard host is the project's official infrastructure, and no untrusted prebuilt binaries are executed.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:51
"${_perlmod}::git+http://git.finalrewind.org/${_perlmod}"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: dreieck
2
# Contributor: Jens Adam <jra@byte.cx>
3
4
_perlmod=Travel-Status-DE-VRR
5
_pkgname=perl-travel-status-de-efa
6
pkgname="${_pkgname}-git"
7
_pkgver='latest'
8
epoch=1
9
pkgver=3.20+r369.20260913.g31c6de0
10
pkgrel=1
11
pkgdesc='Commandline client and Perl module for EFA-based public transit routing interfaces provided by e.g. VRR or VVO. It can request itineraries for train/tram/bus/ferry connections throughout most of Germany, as well as parts of Austria, Switzerland and UK.'
12
url='http://finalrewind.org/projects/Travel-Status-DE-VRR/'
13
license=(
14
'Artistic-1.0-Perl'
15
'CC0-1.0'
16
)
17
arch=('any')
18
depends=(
19
'perl>=5.10.1'
20
'perl-class-accessor'
21
'perl-datetime'
22
'perl-datetime-format-strptime'
23
'perl-getopt-long'
24
'perl-json'
25
'perl-lwp-protocol-https'
26
)
27
makedepends=(
28
'curl>8.7.1' # Because of https://bugs.gentoo.org/930633 / https://github.com/curl/curl/issues/13474
29
'git'
30
'perl-module-build'
31
)
32
checkdepends=(
33
'perl-file-slurp'
34
'perl-test-pod'
35
)
36
provides=(
37
"${_pkgname}=${pkgver}"
38
"perl-travel-status-de-vrr-git=${pkgver}"
39
"perl-travel-status-de-vrr=${pkgver}"
40
)
41
conflicts=(
42
"${_pkgname}"
43
"perl-travel-status-de-vrr"
44
)
45
replaces=(
46
"perl-travel-status-de-vrr-git"
47
)
48
options=('!emptydirs')
49
# source=("http://finalrewind.org/projects/${_perlmod}/${_perlmod}-${pkgver}.tar.gz"{,.asc})
50
source=(
51
"${_perlmod}::git+http://git.finalrewind.org/${_perlmod}"
52
"transport-apis::git+https://github.com/public-transport/transport-apis.git"
53
)
54
sha256sums=(
55
'SKIP'
56
'SKIP'
57
)
58
59
prepare() {
60
cd "${srcdir}/${_perlmod}"
61
62
git submodule init
63
git config submodule.ext/transport-apis.url "${srcdir}/transport-apis"
64
git -c protocol.file.allow=always submodule update
65
66
git log > git.log
67
}
68
69
pkgver() {
70
cd "${srcdir}/${_perlmod}"
71
_descr="$(git describe --tags --long)"
72
_ver="$(printf '%s' "${_descr}" | awk -F '-' '{print $1}')"
73
_rev="r$(git rev-list --count HEAD)"
74
_hash="$(printf '%s' "${_descr}" | awk -F '-' '{print $3}')"
75
_date="$(git log -n 1 --format=tformat:%ci | awk '{print $1}' | tr -d '-')"
76
printf '%s\n' "${_ver}+${_rev}.${_date}.${_hash}"
77
}
78
79
build() {
80
cd "${srcdir}/${_perlmod}"
81
perl Build.PL installdirs=vendor destdir="${pkgdir}"
82
./Build
83
}
84
85
check() {
86
cd "${srcdir}/${_perlmod}"
87
./Build test
88
}
89
90
package() {
91
cd "${srcdir}/${_perlmod}"
92
./Build install
93
install -D -v -m644 COPYING "${pkgdir}/usr/share/licenses/${pkgname}/COPYING.PerlArtistic.txt"
94
install -D -v -m644 README.md "${pkgdir}/usr/share/doc/${_pkgname}/README.md"
95
install -D -v -m644 Changelog "${pkgdir}/usr/share/doc/${_pkgname}/Changelog"
96
install -D -v -m644 git.log "${pkgdir}/usr/share/doc/${_pkgname}/git.log"
97
98
install -D -v -m644 COPYING "${pkgdir}/usr/share/licenses/${pkgname}/COPYING.Travel-Status-DE-DeutscheBahn.PerlArtistic.txt"
99
install -D -v -m644 ext/transport-apis/license "${pkgdir}/usr/share/licenses/${pkgname}/COPYING.git_submodule_transport-apis.CC0.txt"
100
}
101
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |
| 2026-10-12 00:18:51 | Low | 2 |
| 2026-10-11 00:26:05 | Low | 2 |
| 2026-10-10 00:11:52 | Low | 2 |
| 2026-10-09 00:05:33 | Low | 2 |
| 2026-10-08 00:28:03 | Low | 2 |
| 2026-10-07 00:21:34 | Low | 2 |
| 2026-10-06 00:13:36 | Low | 2 |
| 2026-10-05 00:08:03 | Low | 2 |
| 2026-10-04 00:18:08 | Low | 2 |
| 2026-10-03 00:23:04 | Low | 2 |
| 2026-10-02 00:00:32 | Low | 2 |