php83-cli-static-bin
MEDIUM
maintainer evine
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads prebuilt static PHP binaries and a JSON file from a non-whitelisted host (dl.static-php.dev) with SKIP'd checksums, creating a supply-chain risk if the host is compromised or the binaries are swapped.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:70
source=("php-${pkgver}-cli-build-extensions.json::https://dl.static-php.dev/static-php-cli/bulk/build-extensions.json")
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt static PHP binaries and a JSON file from a non-whitelisted host (dl.static-php.dev) with SKIP'd checksums, creating a supply-chain risk if the host is compromised or the binaries are swapped.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: devome <evinedeng@hotmail.com>
2
3
pkgname=php83-cli-static-bin
4
pkgver=8.3.32
5
pkgrel=1
6
pkgdesc="A general-purpose scripting language that is especially suited to web development (8.3.x static precompiled binary)"
7
arch=("x86_64" "aarch64")
8
url="https://www.php.net"
9
license=("PHP-3.01")
10
provides=(
11
"php83-cli"
12
"php83-apcu"
13
"php83-bcmath"
14
"php83-bz2"
15
"php83-calendar"
16
"php83-ctype"
17
"php83-curl"
18
"php83-dba"
19
"php83-dom"
20
"php83-event"
21
"php83-exif"
22
"php83-fileinfo"
23
"php83-filter"
24
"php83-ftp"
25
"php83-gd"
26
"php83-gmp"
27
"php83-iconv"
28
"php83-imagick"
29
"php83-imap"
30
"php83-intl"
31
"php83-libxml"
32
"php83-mbregex"
33
"php83-mbstring"
34
"php83-mysqli"
35
"php83-mysqlnd"
36
"php83-opcache"
37
"php83-openssl"
38
"php83-opentelemetry"
39
"php83-pcntl"
40
"php83-pdo"
41
"php83-pdo_mysql"
42
"php83-pgsql"
43
"php83-phar"
44
"php83-posix"
45
"php83-protobuf"
46
"php83-readline"
47
"php83-redis"
48
"php83-session"
49
"php83-shmop"
50
"php83-simplexml"
51
"php83-soap"
52
"php83-sockets"
53
"php83-sodium"
54
"php83-sqlite"
55
"php83-swoole"
56
"php83-swoole-hook-mysql"
57
"php83-swoole-hook-pgsql"
58
"php83-swoole-hook-sqlite"
59
"php83-sysvmsg"
60
"php83-sysvsem"
61
"php83-sysvshm"
62
"php83-tokenizer"
63
"php83-xml"
64
"php83-xmlreader"
65
"php83-xmlwriter"
66
"php83-xsl"
67
"php83-zip"
68
"php83-zlib"
69
)
70
source=("php-${pkgver}-cli-build-extensions.json::https://dl.static-php.dev/static-php-cli/bulk/build-extensions.json")
71
source_x86_64=("php-${pkgver}-cli-linux-x86_64.tar.gz::https://dl.static-php.dev/static-php-cli/bulk/php-${pkgver}-cli-linux-x86_64.tar.gz")
72
source_aarch64=("php-${pkgver}-cli-linux-aarch64.tar.gz::https://dl.static-php.dev/static-php-cli/bulk/php-${pkgver}-cli-linux-aarch64.tar.gz")
73
sha256sums=('SKIP')
74
sha256sums_x86_64=('SKIP')
75
sha256sums_aarch64=('SKIP')
76
options=(!strip)
77
78
package() {
79
install -Dm755 php "${pkgdir}/usr/bin/php83"
80
}
81
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 00:13:10 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 2 |
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 00:28:05 | Medium | 2 |
| 2026-10-14 00:06:47 | Medium | 2 |
| 2026-10-13 00:23:45 | Medium | 2 |