php83-cli-static-bin
maintainer evine
· 0 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package downloads prebuilt static PHP binaries and a JSON file from a non-whitelisted host (dl.static-php.dev) with SKIP'd checksums, creating a supply-chain risk if the host is compromised or the binaries are swapped.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:70
source=("php-${pkgver}-cli-build-extensions.json::https://dl.static-php.dev/static-php-cli/bulk/build-extensions.json")
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt static PHP binaries and a JSON file from a non-whitelisted host (dl.static-php.dev) with SKIP'd checksums, creating a supply-chain risk if the host is compromised or the binaries are swapped.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: devome <evinedeng@hotmail.com>
2
3
pkgname=php83-cli-static-bin
4
pkgver=8.3.32
5
pkgrel=1
6
pkgdesc="A general-purpose scripting language that is especially suited to web development (8.3.x static precompiled binary)"
7
arch=("x86_64" "aarch64")
8
url="https://www.php.net"
9
license=("PHP-3.01")
10
provides=(
11
"php83-cli"
12
"php83-apcu"
13
"php83-bcmath"
14
"php83-bz2"
15
"php83-calendar"
16
"php83-ctype"
17
"php83-curl"
18
"php83-dba"
19
"php83-dom"
20
"php83-event"
21
"php83-exif"
22
"php83-fileinfo"
23
"php83-filter"
24
"php83-ftp"
25
"php83-gd"
26
"php83-gmp"
27
"php83-iconv"
28
"php83-imagick"
29
"php83-imap"
30
"php83-intl"
31
"php83-libxml"
32
"php83-mbregex"
33
"php83-mbstring"
34
"php83-mysqli"
35
"php83-mysqlnd"
36
"php83-opcache"
37
"php83-openssl"
38
"php83-opentelemetry"
39
"php83-pcntl"
40
"php83-pdo"
41
"php83-pdo_mysql"
42
"php83-pgsql"
43
"php83-phar"
44
"php83-posix"
45
"php83-protobuf"
46
"php83-readline"
47
"php83-redis"
48
"php83-session"
49
"php83-shmop"
50
"php83-simplexml"
51
"php83-soap"
52
"php83-sockets"
53
"php83-sodium"
54
"php83-sqlite"
55
"php83-swoole"
56
"php83-swoole-hook-mysql"
57
"php83-swoole-hook-pgsql"
58
"php83-swoole-hook-sqlite"
59
"php83-sysvmsg"
60
"php83-sysvsem"
61
"php83-sysvshm"
62
"php83-tokenizer"
63
"php83-xml"
64
"php83-xmlreader"
65
"php83-xmlwriter"
66
"php83-xsl"
67
"php83-zip"
68
"php83-zlib"
69
)
70
source=("php-${pkgver}-cli-build-extensions.json::https://dl.static-php.dev/static-php-cli/bulk/build-extensions.json")
71
source_x86_64=("php-${pkgver}-cli-linux-x86_64.tar.gz::https://dl.static-php.dev/static-php-cli/bulk/php-${pkgver}-cli-linux-x86_64.tar.gz")
72
source_aarch64=("php-${pkgver}-cli-linux-aarch64.tar.gz::https://dl.static-php.dev/static-php-cli/bulk/php-${pkgver}-cli-linux-aarch64.tar.gz")
73
sha256sums=('SKIP')
74
sha256sums_x86_64=('SKIP')
75
sha256sums_aarch64=('SKIP')
76
options=(!strip)
77
78
package() {
79
install -Dm755 php "${pkgdir}/usr/bin/php83"
80
}
81
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 00:14:48 | MEDIUM | 2 |
| 2026-07-17 00:06:16 | MEDIUM | 2 |
| 2026-07-16 00:05:41 | MEDIUM | 2 |
| 2026-07-15 00:09:25 | MEDIUM | 2 |