progit-bin

maintainer marmai · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt binary and checksums from the project's own release infrastructure on a self-hosted Git instance; signature verification via minisign with a hardcoded key provides supply-chain integrity, reducing risk despite the non-whitelisted host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary and checksums from the project's own release infrastructure on a self-hosted Git instance; signature verification via minisign with a hardcoded key provides supply-chain integrity, reducing risk despite the non-whitelisted host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://git.sovereign-society.org/ProGit/progit/releases/download/v${pkgver/_/-}/prog-${pkgver/_/-}-x86_64-unknown-linux-gnu.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Markus Maiwald <markus@maiwald.work>
    
      2# Contributor: Virgil, Primus of Libertaria
    
      3pkgname=progit-bin
    
      4pkgver=0.9.0_beta
    
      5pkgrel=1
    
      6pkgdesc="Git-First Project Management — blazing-fast terminal issue tracker with Kanban, Forgejo/GitLab sync, and plugin marketplace"
    
      7arch=('x86_64')
    
      8url="https://progit.dev"
    
      9license=('LicenseRef-LCL-1.0')
    
      10depends=('gcc-libs' 'openssl')
    
      11optdepends=('minisign: for signature verification')
    
      12provides=('progit')
    
      13conflicts=('progit')
    
      14source=("https://git.sovereign-society.org/ProGit/progit/releases/download/v${pkgver/_/-}/prog-${pkgver/_/-}-x86_64-unknown-linux-gnu.tar.gz"
    
      15        "https://git.sovereign-society.org/ProGit/progit/releases/download/v${pkgver/_/-}/prog-${pkgver/_/-}-x86_64-unknown-linux-gnu.tar.gz.minisig"
    
      16        "https://git.sovereign-society.org/ProGit/progit/releases/download/v${pkgver/_/-}/SHA256SUMS"
    
      17        "https://git.sovereign-society.org/ProGit/progit/releases/download/v${pkgver/_/-}/SHA256SUMS.minisig")
    
      18sha256sums=('98a7e0ef9a359a308a66f3d126f67d737e500bf4e10c3c029797674cdc2ef52e'
    
      19            'SKIP'
    
      20            'cf45a8e18263c65dfd9409bca0c5b19305d84616b316538ed264a94582c9ac87'
    
      21            'SKIP')
    
      22
    
      23# Minisign public key for signature verification:
    
      24# RWR0ND/cWMOlrPp+L7tQUO53UwSMgtsqBeGW5zKID/of5GNkz4aNtkZk
    
      25
    
      26validpgpkeys=('RWR0ND/cWMOlrPp+L7tQUO53UwSMgtsqBeGW5zKID/of5GNkz4aNtkZk')
    
      27
    
      28verify() {
    
      29  if command -v minisign &>/dev/null; then
    
      30    minisign -V -P "RWR0ND/cWMOlrPp+L7tQUO53UwSMgtsqBeGW5zKID/of5GNkz4aNtkZk" \
    
      31      -x "prog-${pkgver/_/-}-x86_64-unknown-linux-gnu.tar.gz.minisig" \
    
      32      -m "prog-${pkgver/_/-}-x86_64-unknown-linux-gnu.tar.gz"
    
      33    minisign -V -P "RWR0ND/cWMOlrPp+L7tQUO53UwSMgtsqBeGW5zKID/of5GNkz4aNtkZk" \
    
      34      -x SHA256SUMS.minisig -m SHA256SUMS
    
      35  fi
    
      36}
    
      37
    
      38package() {
    
      39    install -Dm755 "prog" "${pkgdir}/usr/bin/prog"
    
      40    install -Dm644 /dev/stdin "${pkgdir}/usr/share/bash-completion/completions/prog" <<'EOF'
    
      41# Bash completions for prog — generated from progit-shell-completions.bash
    
      42# Source: https://git.sovereign-society.org/ProGit/progit
    
      43EOF
    
      44}
    
      45

Changes since previous scan

--- PKGBUILD @ 2026-07-21 17:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,30 +1,37 @@
 # Maintainer: Markus Maiwald <markus@maiwald.work>
+# Contributor: Virgil, Primus of Libertaria
 pkgname=progit-bin
-pkgver=0.8.3_beta
+pkgver=0.9.0_beta
 pkgrel=1
-pkgdesc="Blazing-fast terminal issue tracker with Kanban, Forgejo/GitLab sync, and plugin marketplace"
+pkgdesc="Git-First Project Management — blazing-fast terminal issue tracker with Kanban, Forgejo/GitLab sync, and plugin marketplace"
 arch=('x86_64')
-url="https://progit.sovereign-society.org"
-license=('LCL-1.0')
+url="https://progit.dev"
+license=('LicenseRef-LCL-1.0')
 depends=('gcc-libs' 'openssl')
 optdepends=('minisign: for signature verification')
 provides=('progit')
 conflicts=('progit')
-source=("https://git.sovereign-society.org/ProGit/progit/releases/download/v${pkgver//_/-}/prog-v${pkgver//_/-}-x86_64-unknown-linux-gnu.tar.gz"
-        "https://git.sovereign-society.org/ProGit/progit/releases/download/v${pkgver//_/-}/prog-v${pkgver//_/-}-x86_64-unknown-linux-gnu.tar.gz.minisig"
-        "https://git.sovereign-society.org/ProGit/progit/releases/download/v${pkgver//_/-}/SHA256SUMS"
-        "https://git.sovereign-society.org/ProGit/progit/releases/download/v${pkgver//_/-}/SHA256SUMS.minisig")
-# SHA256s updated by release CI (tag-triggered build)
-sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP')
+source=("https://git.sovereign-society.org/ProGit/progit/releases/download/v${pkgver/_/-}/prog-${pkgver/_/-}-x86_64-unknown-linux-gnu.tar.gz"
+        "https://git.sovereign-society.org/ProGit/progit/releases/download/v${pkgver/_/-}/prog-${pkgver/_/-}-x86_64-unknown-linux-gnu.tar.gz.minisig"
+        "https://git.sovereign-society.org/ProGit/progit/releases/download/v${pkgver/_/-}/SHA256SUMS"
+        "https://git.sovereign-society.org/ProGit/progit/releases/download/v${pkgver/_/-}/SHA256SUMS.minisig")
+sha256sums=('98a7e0ef9a359a308a66f3d126f67d737e500bf4e10c3c029797674cdc2ef52e'
+            'SKIP'
+            'cf45a8e18263c65dfd9409bca0c5b19305d84616b316538ed264a94582c9ac87'
+            'SKIP')
 
 # Minisign public key for signature verification:
 # RWR0ND/cWMOlrPp+L7tQUO53UwSMgtsqBeGW5zKID/of5GNkz4aNtkZk
 
+validpgpkeys=('RWR0ND/cWMOlrPp+L7tQUO53UwSMgtsqBeGW5zKID/of5GNkz4aNtkZk')
+
 verify() {
   if command -v minisign &>/dev/null; then
     minisign -V -P "RWR0ND/cWMOlrPp+L7tQUO53UwSMgtsqBeGW5zKID/of5GNkz4aNtkZk" \
-      -x "prog-v${pkgver//_/-}-x86_64-unknown-linux-gnu.tar.gz.minisig" \
-      -m "prog-v${pkgver//_/-}-x86_64-unknown-linux-gnu.tar.gz"
+      -x "prog-${pkgver/_/-}-x86_64-unknown-linux-gnu.tar.gz.minisig" \
+      -m "prog-${pkgver/_/-}-x86_64-unknown-linux-gnu.tar.gz"
+    minisign -V -P "RWR0ND/cWMOlrPp+L7tQUO53UwSMgtsqBeGW5zKID/of5GNkz4aNtkZk" \
+      -x SHA256SUMS.minisig -m SHA256SUMS
   fi
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 21:18:19	MEDIUM	1
2026-07-21 17:17:32	MEDIUM	1
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2