progit-bin

LOW

maintainer marmai 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt binary and checksums from the project's own release infrastructure on a self-hosted Git instance; signature verification via minisign with a hardcoded key provides supply-chain integrity, reducing risk despite the non-whitelisted host.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary and checksums from the project's own release infrastructure on a self-hosted Git instance; signature verification via minisign with a hardcoded key provides supply-chain integrity, reducing risk despite the non-whitelisted host.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://git.sovereign-society.org/ProGit/progit/releases/download/v${pkgver/_/-}/prog-${pkgver/_/-}-x86_64-unknown-linux-gnu.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Markus Maiwald <markus@maiwald.work>
    
      2# Contributor: Virgil, Primus of Libertaria
    
      3pkgname=progit-bin
    
      4pkgver=0.9.0_beta
    
      5pkgrel=1
    
      6pkgdesc="Git-First Project Management — blazing-fast terminal issue tracker with Kanban, Forgejo/GitLab sync, and plugin marketplace"
    
      7arch=('x86_64')
    
      8url="https://progit.dev"
    
      9license=('LicenseRef-LCL-1.0')
    
      10depends=('gcc-libs' 'openssl')
    
      11optdepends=('minisign: for signature verification')
    
      12provides=('progit')
    
      13conflicts=('progit')
    
      14source=("https://git.sovereign-society.org/ProGit/progit/releases/download/v${pkgver/_/-}/prog-${pkgver/_/-}-x86_64-unknown-linux-gnu.tar.gz"
    
      15        "https://git.sovereign-society.org/ProGit/progit/releases/download/v${pkgver/_/-}/prog-${pkgver/_/-}-x86_64-unknown-linux-gnu.tar.gz.minisig"
    
      16        "https://git.sovereign-society.org/ProGit/progit/releases/download/v${pkgver/_/-}/SHA256SUMS"
    
      17        "https://git.sovereign-society.org/ProGit/progit/releases/download/v${pkgver/_/-}/SHA256SUMS.minisig")
    
      18sha256sums=('98a7e0ef9a359a308a66f3d126f67d737e500bf4e10c3c029797674cdc2ef52e'
    
      19            'SKIP'
    
      20            'cf45a8e18263c65dfd9409bca0c5b19305d84616b316538ed264a94582c9ac87'
    
      21            'SKIP')
    
      22
    
      23# Minisign public key for signature verification:
    
      24# RWR0ND/cWMOlrPp+L7tQUO53UwSMgtsqBeGW5zKID/of5GNkz4aNtkZk
    
      25
    
      26validpgpkeys=('RWR0ND/cWMOlrPp+L7tQUO53UwSMgtsqBeGW5zKID/of5GNkz4aNtkZk')
    
      27
    
      28verify() {
    
      29  if command -v minisign &>/dev/null; then
    
      30    minisign -V -P "RWR0ND/cWMOlrPp+L7tQUO53UwSMgtsqBeGW5zKID/of5GNkz4aNtkZk" \
    
      31      -x "prog-${pkgver/_/-}-x86_64-unknown-linux-gnu.tar.gz.minisig" \
    
      32      -m "prog-${pkgver/_/-}-x86_64-unknown-linux-gnu.tar.gz"
    
      33    minisign -V -P "RWR0ND/cWMOlrPp+L7tQUO53UwSMgtsqBeGW5zKID/of5GNkz4aNtkZk" \
    
      34      -x SHA256SUMS.minisig -m SHA256SUMS
    
      35  fi
    
      36}
    
      37
    
      38package() {
    
      39    install -Dm755 "prog" "${pkgdir}/usr/bin/prog"
    
      40    install -Dm644 /dev/stdin "${pkgdir}/usr/share/bash-completion/completions/prog" <<'EOF'
    
      41# Bash completions for prog — generated from progit-shell-completions.bash
    
      42# Source: https://git.sovereign-society.org/ProGit/progit
    
      43EOF
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2