prism-harness-suite
maintainer marmai
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
Builds from a self-hosted Forgejo instance (git.sovereign-society.org) that is plausibly the project's own infrastructure; clones additional repos from the same host at build time, which is unconventional but not inherently malicious. The SKIP checksum on a git tag is normal AUR practice. No obfuscation, no exfiltration, no piped-to-shell payloads; the main concern is that the non-whitelisted personal forge could be swapped, but the realistic worst case is installing untrusted JS bundles run via Bun, which is a low-to-medium supply-chain risk typical of any AUR package building from a personal host.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Builds from a self-hosted Forgejo instance (git.sovereign-society.org) that is plausibly the project's own infrastructure; clones additional repos from the same host at build time, which is unconventional but not inherently malicious. The SKIP checksum on a git tag is normal AUR practice. No obfuscation, no exfiltration, no piped-to-shell payloads; the main concern is that the non-whitelisted personal forge could be swapped, but the realistic worst case is installing untrusted JS bundles run via Bun, which is a low-to-medium supply-chain risk typical of any AUR package building from a personal host.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:13
source=("git+https://git.sovereign-society.org/prism/prism-harness.git#tag=v1.0.0-rc.1")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Markus Maiwald <markus@maiwald.tk>
2
pkgname=prism-harness-suite
3
pkgver=1.0.0_rc1
4
pkgrel=1
5
pkgdesc="PRISM Harness suite - small bundles sharing one Bun runtime (harness, loop, proxy, route, sober)"
6
arch=('x86_64')
7
url="https://git.sovereign-society.org/prism"
8
license=('custom:LSL-1.0')
9
depends=('bun')
10
makedepends=('git' 'bun')
11
provides=('prism-harness' 'prism-loop' 'prism-proxy' 'prism-route' 'prism-sober')
12
conflicts=('prism-harness' 'prism-loop' 'prism-proxy' 'prism-route' 'prism-sober')
13
source=("git+https://git.sovereign-society.org/prism/prism-harness.git#tag=v1.0.0-rc.1")
14
sha256sums=('SKIP')
15
16
build() {
17
cd "$srcdir/prism-harness"
18
19
# Clone the other components (they are separate repos on Forgejo)
20
for r in prism-loop prism-sober prism-proxy prism-route; do
21
if [ ! -d "../$r" ]; then
22
git clone --depth 1 "https://git.sovereign-society.org/prism/$r.git" "../$r"
23
fi
24
done
25
26
# Build small bundles (each package has its "build" script from the suite setup)
27
for d in . ../prism-loop ../prism-sober ../prism-proxy ../prism-route; do
28
if [ -f "$d/package.json" ]; then
29
(cd "$d" && bun install --frozen-lockfile 2>/dev/null || bun install; bun run --if-present build) || echo "note: build for $d"
30
fi
31
done
32
}
33
34
package() {
35
cd "$srcdir"
36
37
# Install each component's built tree to /usr/lib/prism/<name> and wrapper in /usr/bin
38
# This keeps node_modules for native deps (e.g. sharp in proxy) next to the code
39
# Small size, one Bun runtime
40
41
install -d "$pkgdir/usr/lib/prism"
42
install -d "$pkgdir/usr/bin"
43
44
for comp in prism-harness prism-loop prism-sober prism-proxy prism-route; do
45
srcdir_comp="$srcdir"
46
if [ "$comp" != "prism-harness" ]; then
47
srcdir_comp="$srcdir/../$comp"
48
fi
49
50
if [ -d "$srcdir_comp/dist" ]; then
51
# Copy the full component (for deps) or at least dist + needed
52
install -d "$pkgdir/usr/lib/prism/$comp"
53
cp -r "$srcdir_comp/dist" "$pkgdir/usr/lib/prism/$comp/" 2>/dev/null || true
54
55
# For components with node_modules (proxy etc), copy if present after build
56
if [ -d "$srcdir_comp/node_modules" ]; then
57
cp -r "$srcdir_comp/node_modules" "$pkgdir/usr/lib/prism/$comp/" 2>/dev/null || true
58
fi
59
60
# Copy package.json if needed for resolution
61
if [ -f "$srcdir_comp/package.json" ]; then
62
install -Dm644 "$srcdir_comp/package.json" "$pkgdir/usr/lib/prism/$comp/package.json"
63
fi
64
65
# The bundle .js
66
bundle="$pkgdir/usr/lib/prism/$comp/dist/$comp.js"
67
if [ -f "$bundle" ]; then
68
# Wrapper script (ensures correct exec with bun and resolution)
69
cat > "$pkgdir/usr/bin/$comp" << WRAP
70
#!/usr/bin/env sh
71
exec /usr/bin/bun "/usr/lib/prism/$comp/dist/$comp.js" "\$@"
72
WRAP
73
chmod +x "$pkgdir/usr/bin/$comp"
74
fi
75
else
76
echo "warning: no dist for $comp"
77
fi
78
done
79
80
# Install helper
81
if [ -f "prism-harness/install.sh" ]; then
82
install -Dm755 "prism-harness/install.sh" "$pkgdir/usr/share/doc/$pkgname/install.sh"
83
fi
84
}
85
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 3 |
| 2026-07-22 00:29:32 | LOW | 3 |
| 2026-07-21 00:24:15 | LOW | 3 |
| 2026-07-20 00:19:49 | LOW | 3 |
| 2026-07-19 00:17:08 | LOW | 3 |
| 2026-07-18 00:14:48 | LOW | 3 |
| 2026-07-17 00:06:16 | LOW | 3 |
| 2026-07-16 00:05:41 | LOW | 3 |
| 2026-07-15 00:09:25 | LOW | 3 |