perl-travel-status-de-iris-git
maintainer dreieck
· 2 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The source is a git clone from the project's own domain (git.finalrewind.org), which is plausibly controlled by the upstream developer; building from a non-whitelisted but project-owned host is normal for AUR packages and poses low risk.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git clone from the project's own domain (git.finalrewind.org), which is plausibly controlled by the upstream developer; building from a non-whitelisted but project-owned host is normal for AUR packages and poses low risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:50
"${_perlmod}::git+https://git.finalrewind.org/${_perlmod}"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: dreieck
2
# Contributor: Jens Adam <jra@byte.cx>
3
4
_perlmod=Travel-Status-DE-IRIS
5
_pkgname=perl-travel-status-de-iris
6
pkgname="${_pkgname}-git"
7
_pkgver="latest"
8
epoch=1
9
pkgver=2.01+r811.20251228.g80f193c
10
pkgrel=1
11
pkgdesc='Interface to IRIS-based web departure monitors (as used by DeutscheBahn)'
12
url='http://finalrewind.org/projects/Travel-Status-DE-IRIS/'
13
license=('PerlArtistic')
14
arch=('any')
15
depends=(
16
'perl-cache'
17
'perl-class-accessor'
18
'perl-datetime'
19
'perl-datetime-format-strptime'
20
# 'perl-geo-distance'
21
'perl-gis-distance' # This one is problematic, since it depends on 'perl-geo-point' which in turn depends on 'perl-geo-proj' which cannot be maintained anymore due to changes in 'proj4'. Upstream should switch to 'perl-geo-distance' instead.
22
'perl-list-compare'
23
'perl-list-moreutils'
24
'perl-list-utilsby'
25
'perl-libwww'
26
'perl-lwp-protocol-https'
27
'perl-package-deprecationmanager'
28
'perl-strictures'
29
'perl-text-levenshtein'
30
'perl-xml-libxml'
31
)
32
makedepends=(
33
'curl>8.7.1' # Because of https://bugs.gentoo.org/930633 / https://github.com/curl/curl/issues/13474
34
'git'
35
'perl-file-slurp'
36
'perl-module-build'
37
'perl-test-compile'
38
'perl-test-fatal'
39
'perl-test-pod'
40
'perl-text-csv'
41
)
42
checkdepends=(
43
'perl-test-number-delta'
44
)
45
provides=("${_pkgname}=${pkgver}")
46
conflicts=("${_pkgname}")
47
options=('!emptydirs')
48
# source=("http://finalrewind.org/projects/${_perlmod}/${_perlmod}-${pkgver}.tar.gz"{,.asc})
49
source=(
50
"${_perlmod}::git+https://git.finalrewind.org/${_perlmod}"
51
'LICENSE.PerlArtistic.txt'
52
)
53
sha256sums=(
54
'SKIP'
55
'916a330e64df209a924120bfddea0373db385eb3854e96d1a3dda6e0ea130c80'
56
)
57
58
pkgver() {
59
cd "${srcdir}/${_perlmod}"
60
# {
61
# grep -e '\$VERSION[[:space:]]*=[[:space:]]*' './bin/db-iris' | head -n 1; echo 'print $VERSION'
62
# } | perl
63
64
_descr="$(git describe --tags --long)"
65
_ver="$(printf '%s' "${_descr}" | awk -F '-' '{print $1}')"
66
_rev="r$(git rev-list --count HEAD)"
67
_hash="$(printf '%s' "${_descr}" | awk -F '-' '{print $3}')"
68
_date="$(git log -n 1 --format=tformat:%ci | awk '{print $1}' | tr -d '-')"
69
printf '%s\n' "${_ver}+${_rev}.${_date}.${_hash}"
70
}
71
72
build() {
73
cd "${srcdir}/${_perlmod}"
74
sed -i 's/Text::LevenshteinXS/Text::Levenshtein/' Build.PL lib/Travel/Status/DE/IRIS/Stations.pm.PL # Don't know what this is for, it was here when I adopted this package.
75
# sed -i 's/GIS::Distance/Geo::Distance/' Build.PL # Patch to use Geo::Distance instead of GIS::Distance.
76
# export DB_IRIS_DEB_BUILD=1 # Also needed in order to use Geo::Distance instead of GIS::Distance.
77
perl Build.PL installdirs=vendor destdir="${pkgdir}"
78
./Build
79
}
80
81
# check() {
82
# ### 2022-01-25: `./Build test` fails, most probably due to the fact that GEO::Proj4 upstream can no longer be maintained due to changes in proj library.
83
# cd "${srcdir}/${_perlmod}"
84
# ./Build test
85
# }
86
87
package() {
88
cd "${srcdir}/${_perlmod}"
89
# export DB_IRIS_DEB_BUILD=1 # Also needed in order to use Geo::Distance instead of GIS::Distance.
90
./Build install
91
for _docfile in README.md Changelog; do
92
install -D -v -m644 "${_docfile}" "${pkgdir}/usr/share/doc/${_pkgname}/${_docfile}"
93
done
94
install -D -v -m644 "${srcdir}/LICENSE.PerlArtistic.txt" "${pkgdir}/usr/share/licenses/${pkgname}/COPYING.PerlArtistic.txt"
95
}
96
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |