pound

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is downloaded from the official project host apsis.ch, which is the legitimate domain for Pound; the non-whitelisted host is the project's own site, and the package builds from source, posing no supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is downloaded from the official project host apsis.ch, which is the legitimate domain for Pound; the non-whitelisted host is the project's own site, and the package builds from source, posing no supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("http://www.apsis.ch/${pkgname}/${_name}-${pkgver}.tgz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: David Runge <dvzrv@archlinux.org>
    
      2# Contributor: Sergej Pupykin <pupykin.s+arch@gmail.com>
    
      3# Contributor: Douglas Soares de Andrade <dsa@aur.archlinux.org>
    
      4# Contributor: Roberto Alsina <ralsina@kde.org>
    
      5
    
      6_name=Pound
    
      7pkgname=pound
    
      8pkgver=3.0.2
    
      9pkgrel=3
    
      10pkgdesc="A reverse proxy, load balancer, and SSL wrapper"
    
      11arch=(x86_64)
    
      12url="https://www.apsis.ch/pound.html"
    
      13license=(GPL3)
    
      14depends=(gcc-libs glibc libyaml nanomsg pcre2)
    
      15makedepends=(cmake gperftools mbedtls uthash)
    
      16backup=("etc/${pkgname}/${pkgname}.yaml")
    
      17source=("http://www.apsis.ch/${pkgname}/${_name}-${pkgver}.tgz"
    
      18        "${_name}-${pkgver}.tgz.asc::http://www.apsis.ch/${pkgname}/${_name}-${pkgver}.asc"
    
      19        "${pkgname}-3.0-runtime_dir.patch"
    
      20        "${pkgname}.service"
    
      21        "${pkgname}.yaml")
    
      22sha512sums=('4c96a93df2b340049778ed7782377e521fbdd7b6ccaa157748b05941ac7a825b2688f37f3081a7e577b2fa1ec4f64d68a25d27af2210f59da5be0dc10d1391e9'
    
      23            'SKIP'
    
      24            '25db5c13750c2770ae5a91d850f2f00e888474a05b2464c6f03ebe4dc628c86edf8df640daa96e9dcb7240de43537a731671376f20e0dfb599ef5fc2eaf6c053'
    
      25            '887ebace94fb6974b34e096c3f9d85e7e45186f816f8a0b4218ffecf2bf041702bc5d40547ca5883691e1d5f959e28b8ce3aac0f12c877760c0e80d8319f57e9'
    
      26            '329fb0064f9720cc41332894d3e96e098ffd789d13bcb3b35d67dd9f7b4c0667d1b4cf1d93df9427b4e867d5f0b5857be412ae8d34abed5aa3c2774a499b3292')
    
      27b2sums=('0e3f2dc69771a1d1f3de00a721f02cdc4ff31f4d17ab81f64c368668f03c0c1f12484e2d40e7c1d2d203b033488f2bad57cafd8da5022dfe680a09cdc6b73bec'
    
      28        'SKIP'
    
      29        'eba66845b02eff8cea9353f1617f9fcbce040609ea22a1061d98a69c109fed1aaaf6fb338cde1c969153df383def7ae5e3231f281140d32702acfb8c628fa0e4'
    
      30        '886e7218d0098f86edfde32b0d8ccdf47f7a8d6a3417144bbd9279cac14d51065fe72b312844ff6a24be6d16183a3b4a44b0d012c1d08808d07ea96d660ff69f'
    
      31        'a7ebb7714abf8bc7c2c0f627f6fdcc226a293277a98455bd52340536754ef3a5aef75340b8535402c78a9a754f78d4793c1d7b0c15b0b8d393fd3760a6398858')
    
      32validpgpkeys=('8BB562A0F1DB703FB7EB1E95AB72C62A8691DD02') # Robert Segall <roseg@apsis.ch>
    
      33
    
      34prepare() {
    
      35  mv -v "${_name}-${pkgver}" "${pkgname}-${pkgver}"
    
      36  cd "${pkgname}-${pkgver}"
    
      37  # set runtime dir to /run/pound
    
      38  patch -Np1 -i "../${pkgname}-3.0-runtime_dir.patch"
    
      39  # remove vendored uthash so we build with the packaged version
    
      40  rm -v include/ut{hash,array}.h
    
      41}
    
      42
    
      43build() {
    
      44  cd "${pkgname}-${pkgver}"
    
      45  cmake -DCMAKE_INSTALL_PREFIX=/usr \
    
      46        -DCMAKE_BUILD_TYPE='None' \
    
      47        -Wno-dev \
    
      48        -B build \
    
      49        -S .
    
      50  make VERBOSE=1 -C build
    
      51}
    
      52
    
      53package() {
    
      54  depends+=(libmbedtls.so libmbedcrypto.so libmbedx509.so
    
      55  libtcmalloc.so)
    
      56
    
      57  cd "${pkgname}-${pkgver}"
    
      58  # cmake setup has no install target :(
    
      59  install -vDm 755 build/"${pkgname}" -t "${pkgdir}/usr/bin/"
    
      60  # configuration
    
      61  install -vDm 644 "../${pkgname}.yaml" -t "${pkgdir}/etc/${pkgname}/"
    
      62  # systemd service
    
      63  install -vDm 644 "../${pkgname}.service" \
    
      64    -t "${pkgdir}/usr/lib/systemd/system/"
    
      65  # man page
    
      66  install -vDm 644 man/${pkgname}.8 -t "${pkgdir}/usr/share/man/man8/"
    
      67  # docs
    
      68  install -vDm 644 README.md \
    
      69    -t "${pkgdir}/usr/share/doc/${pkgname}/"
    
      70}
    
      71

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2