progit-bin

LOW

maintainer marmai 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt binary and checksums from the project's own release infrastructure on a self-hosted Git instance; signature verification via minisign with a hardcoded key provides supply-chain integrity, reducing risk despite the non-whitelisted host.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary and checksums from the project's own release infrastructure on a self-hosted Git instance; signature verification via minisign with a hardcoded key provides supply-chain integrity, reducing risk despite the non-whitelisted host.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://git.sovereign-society.org/ProGit/progit/releases/download/v${pkgver/_/-}/prog-${pkgver/_/-}-x86_64-unknown-linux-gnu.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Markus Maiwald <markus@maiwald.work>
    
      2# Contributor: Virgil, Primus of Libertaria
    
      3pkgname=progit-bin
    
      4pkgver=0.9.0_beta
    
      5pkgrel=1
    
      6pkgdesc="Git-First Project Management — blazing-fast terminal issue tracker with Kanban, Forgejo/GitLab sync, and plugin marketplace"
    
      7arch=('x86_64')
    
      8url="https://progit.dev"
    
      9license=('LicenseRef-LCL-1.0')
    
      10depends=('gcc-libs' 'openssl')
    
      11optdepends=('minisign: for signature verification')
    
      12provides=('progit')
    
      13conflicts=('progit')
    
      14source=("https://git.sovereign-society.org/ProGit/progit/releases/download/v${pkgver/_/-}/prog-${pkgver/_/-}-x86_64-unknown-linux-gnu.tar.gz"
    
      15        "https://git.sovereign-society.org/ProGit/progit/releases/download/v${pkgver/_/-}/prog-${pkgver/_/-}-x86_64-unknown-linux-gnu.tar.gz.minisig"
    
      16        "https://git.sovereign-society.org/ProGit/progit/releases/download/v${pkgver/_/-}/SHA256SUMS"
    
      17        "https://git.sovereign-society.org/ProGit/progit/releases/download/v${pkgver/_/-}/SHA256SUMS.minisig")
    
      18sha256sums=('98a7e0ef9a359a308a66f3d126f67d737e500bf4e10c3c029797674cdc2ef52e'
    
      19            'SKIP'
    
      20            'cf45a8e18263c65dfd9409bca0c5b19305d84616b316538ed264a94582c9ac87'
    
      21            'SKIP')
    
      22
    
      23# Minisign public key for signature verification:
    
      24# RWR0ND/cWMOlrPp+L7tQUO53UwSMgtsqBeGW5zKID/of5GNkz4aNtkZk
    
      25
    
      26validpgpkeys=('RWR0ND/cWMOlrPp+L7tQUO53UwSMgtsqBeGW5zKID/of5GNkz4aNtkZk')
    
      27
    
      28verify() {
    
      29  if command -v minisign &>/dev/null; then
    
      30    minisign -V -P "RWR0ND/cWMOlrPp+L7tQUO53UwSMgtsqBeGW5zKID/of5GNkz4aNtkZk" \
    
      31      -x "prog-${pkgver/_/-}-x86_64-unknown-linux-gnu.tar.gz.minisig" \
    
      32      -m "prog-${pkgver/_/-}-x86_64-unknown-linux-gnu.tar.gz"
    
      33    minisign -V -P "RWR0ND/cWMOlrPp+L7tQUO53UwSMgtsqBeGW5zKID/of5GNkz4aNtkZk" \
    
      34      -x SHA256SUMS.minisig -m SHA256SUMS
    
      35  fi
    
      36}
    
      37
    
      38package() {
    
      39    install -Dm755 "prog" "${pkgdir}/usr/bin/prog"
    
      40    install -Dm644 /dev/stdin "${pkgdir}/usr/share/bash-completion/completions/prog" <<'EOF'
    
      41# Bash completions for prog — generated from progit-shell-completions.bash
    
      42# Source: https://git.sovereign-society.org/ProGit/progit
    
      43EOF
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2