perl-travel-status-de-iris-git
LOW
maintainer dreieck
2 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The source uses a git repository from a non-whitelisted host, but it is the project's own source code being built, which is normal for AUR packages, and no unverified prebuilt binaries or malicious payloads are involved.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The source uses a git repository from a non-whitelisted host, but it is the project's own source code being built, which is normal for AUR packages, and no unverified prebuilt binaries or malicious payloads are involved.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:50
"${_perlmod}::git+https://git.finalrewind.org/${_perlmod}"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: dreieck
2
# Contributor: Jens Adam <jra@byte.cx>
3
4
_perlmod=Travel-Status-DE-IRIS
5
_pkgname=perl-travel-status-de-iris
6
pkgname="${_pkgname}-git"
7
_pkgver="latest"
8
epoch=1
9
pkgver=2.05+r837.20260704.gee093d8
10
pkgrel=1
11
pkgdesc='Interface to IRIS-based web departure monitors (as used by DeutscheBahn)'
12
url='http://finalrewind.org/projects/Travel-Status-DE-IRIS/'
13
license=('PerlArtistic')
14
arch=('any')
15
depends=(
16
'perl-cache'
17
'perl-class-accessor'
18
'perl-datetime'
19
'perl-datetime-format-strptime'
20
# 'perl-geo-distance'
21
'perl-gis-distance' # This one is problematic, since it depends on 'perl-geo-point' which in turn depends on 'perl-geo-proj' which cannot be maintained anymore due to changes in 'proj4'. Upstream should switch to 'perl-geo-distance' instead.
22
'perl-list-compare'
23
'perl-list-moreutils'
24
'perl-list-utilsby'
25
'perl-libwww'
26
'perl-lwp-protocol-https'
27
'perl-package-deprecationmanager'
28
'perl-strictures'
29
'perl-text-levenshtein'
30
'perl-xml-libxml'
31
)
32
makedepends=(
33
'curl>8.7.1' # Because of https://bugs.gentoo.org/930633 / https://github.com/curl/curl/issues/13474
34
'git'
35
'perl-file-slurp'
36
'perl-module-build'
37
'perl-test-compile'
38
'perl-test-fatal'
39
'perl-test-pod'
40
'perl-text-csv'
41
)
42
checkdepends=(
43
'perl-test-number-delta'
44
)
45
provides=("${_pkgname}=${pkgver}")
46
conflicts=("${_pkgname}")
47
options=('!emptydirs')
48
# source=("http://finalrewind.org/projects/${_perlmod}/${_perlmod}-${pkgver}.tar.gz"{,.asc})
49
source=(
50
"${_perlmod}::git+https://git.finalrewind.org/${_perlmod}"
51
'LICENSE.PerlArtistic.txt'
52
)
53
sha256sums=(
54
'SKIP'
55
'916a330e64df209a924120bfddea0373db385eb3854e96d1a3dda6e0ea130c80'
56
)
57
58
pkgver() {
59
cd "${srcdir}/${_perlmod}"
60
# {
61
# grep -e '\$VERSION[[:space:]]*=[[:space:]]*' './bin/db-iris' | head -n 1; echo 'print $VERSION'
62
# } | perl
63
64
_descr="$(git describe --tags --long)"
65
_ver="$(printf '%s' "${_descr}" | awk -F '-' '{print $1}')"
66
_rev="r$(git rev-list --count HEAD)"
67
_hash="$(printf '%s' "${_descr}" | awk -F '-' '{print $3}')"
68
_date="$(git log -n 1 --format=tformat:%ci | awk '{print $1}' | tr -d '-')"
69
printf '%s\n' "${_ver}+${_rev}.${_date}.${_hash}"
70
}
71
72
build() {
73
cd "${srcdir}/${_perlmod}"
74
sed -i 's/Text::LevenshteinXS/Text::Levenshtein/' Build.PL lib/Travel/Status/DE/IRIS/Stations.pm.PL # Don't know what this is for, it was here when I adopted this package.
75
# sed -i 's/GIS::Distance/Geo::Distance/' Build.PL # Patch to use Geo::Distance instead of GIS::Distance.
76
# export DB_IRIS_DEB_BUILD=1 # Also needed in order to use Geo::Distance instead of GIS::Distance.
77
perl Build.PL installdirs=vendor destdir="${pkgdir}"
78
./Build
79
}
80
81
# check() {
82
# ### 2022-01-25: `./Build test` fails, most probably due to the fact that GEO::Proj4 upstream can no longer be maintained due to changes in proj library.
83
# cd "${srcdir}/${_perlmod}"
84
# ./Build test
85
# }
86
87
package() {
88
cd "${srcdir}/${_perlmod}"
89
# export DB_IRIS_DEB_BUILD=1 # Also needed in order to use Geo::Distance instead of GIS::Distance.
90
./Build install
91
for _docfile in README.md Changelog; do
92
install -D -v -m644 "${_docfile}" "${pkgdir}/usr/share/doc/${_pkgname}/${_docfile}"
93
done
94
install -D -v -m644 "${srcdir}/LICENSE.PerlArtistic.txt" "${pkgdir}/usr/share/licenses/${pkgname}/COPYING.PerlArtistic.txt"
95
}
96
Changes since previous scan
--- PKGBUILD @ 2026-09-05 00:16+++ PKGBUILD @ 2026-09-17 00:27@@ -6,7 +6,7 @@ pkgname="${_pkgname}-git" _pkgver="latest" epoch=1-pkgver=2.01+r811.20251228.g80f193c+pkgver=2.05+r837.20260704.gee093d8 pkgrel=1 pkgdesc='Interface to IRIS-based web departure monitors (as used by DeutscheBahn)' url='http://finalrewind.org/projects/Travel-Status-DE-IRIS/'Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 16:00:23 | Medium | 1 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |