prolewatch

CLEAN

maintainer hheinz 0 votes scanned 2026-09-27 00:07:07.510666

View on AUR

Triggered rules

Clean AI review downgraded a static finding llm_review

The static rules flagged this LOW, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it CLEAN (confidence 95%): The package builds from a verifiable source tarball and signature hosted on GitHub, uses vendored Go dependencies with offline build settings, and installs only compiled binaries and static documentation files without executing remote code or introducing untrusted payloads.

1 higher static finding superseded - not the current verdict (shown for transparency)

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

PKGBUILD

      1# Maintainer: Holger Heinz <79228197+holgerjh@users.noreply.github.com>
    
      2
    
      3pkgname=prolewatch
    
      4pkgver=0.12.4
    
      5pkgrel=1
    
      6pkgdesc='AUR security scanner and build sandbox with network isolation, optional AI review and root action inspection'
    
      7arch=('x86_64')
    
      8url='https://github.com/holgerjh/prolewatch'
    
      9license=('AGPL-3.0-only')
    
      10depends=('bash' 'bubblewrap' 'coreutils' 'findutils' 'glibc' 'gnupg' 'libarchive' 'pacman' 'sed' 'shadow>=4.20' 'sudo' 'systemd' 'util-linux')
    
      11makedepends=('go>=1.26.6')
    
      12optdepends=(
    
      13  'yay>=13.0.1: AUR transaction driver; run prolewatch setup after installation'
    
      14  'openai-codex: Codex-backed AI review'
    
      15  'claude-code: Anthropic-backed AI review'
    
      16)
    
      17if [[ ${pkgname} == prolewatch-dev ]]; then
    
      18  provides=('prolewatch')
    
      19  conflicts=('prolewatch')
    
      20fi
    
      21options=('!debug' '!lto' '!strip')
    
      22backup=('etc/prolewatch/config.yaml')
    
      23
    
      24source=("prolewatch-${pkgver}.tar.gz::https://github.com/holgerjh/prolewatch/releases/download/v${pkgver}/prolewatch-${pkgver}.tar.gz"
    
      25        "prolewatch-${pkgver}.tar.gz.sig::https://github.com/holgerjh/prolewatch/releases/download/v${pkgver}/prolewatch-${pkgver}.tar.gz.sig")
    
      26sha256sums=('d83da9a6830ca3f98f022dfd9b6c75840db742c712e2f160bbb12d87d4c90d44'
    
      27             'SKIP')
    
      28validpgpkeys=('296E983E7120909958BD38E557F1F87148E02B27')
    
      29
    
      30prepare() {
    
      31  cd "${srcdir}/prolewatch-${pkgver}"
    
      32  # Use vendored dependencies and keep Go state inside the build directory.
    
      33  export HOME="${srcdir}/home"
    
      34  export GOCACHE="${srcdir}/gocache"
    
      35  export GOMODCACHE="${srcdir}/gomodcache"
    
      36  export GOENV=off GOTOOLCHAIN=local GOWORK=off
    
      37  export GOFLAGS='-mod=vendor -buildvcs=false' GOPROXY=off GOSUMDB=off
    
      38  export GOPRIVATE= GONOPROXY= GONOSUMDB=
    
      39  install -d -m 0700 "${HOME}" "${GOCACHE}" "${GOMODCACHE}"
    
      40  go list ./... >/dev/null
    
      41}
    
      42
    
      43build() {
    
      44  cd "${srcdir}/prolewatch-${pkgver}"
    
      45  HOME="${srcdir}/home" \
    
      46  GOCACHE="${srcdir}/gocache" \
    
      47  GOMODCACHE="${srcdir}/gomodcache" \
    
      48  PROLEWATCH_GOCACHE="${srcdir}/gocache" \
    
      49  PROLEWATCH_GOMODCACHE="${srcdir}/gomodcache" \
    
      50  PROLEWATCH_BUILD_HOME="${srcdir}/home" \
    
      51  PROLEWATCH_BUILD_DIR="${srcdir}/prolewatch-build" \
    
      52  PROLEWATCH_OFFLINE=1 \
    
      53  PROLEWATCH_GO_MOD_MODE=vendor \
    
      54    ./scripts/build.sh
    
      55}
    
      56
    
      57check() {
    
      58  cd "${srcdir}/prolewatch-${pkgver}"
    
      59  env -i \
    
      60    HOME="${srcdir}/home" PATH=/usr/bin TMPDIR="${srcdir}" LANG=C.UTF-8 LC_ALL=C.UTF-8 \
    
      61    GOENV=off GOTOOLCHAIN=local GOWORK=off GOFLAGS='-mod=vendor -buildvcs=false' GOPROXY=off GOSUMDB=off \
    
      62    GOCACHE="${srcdir}/gocache" GOMODCACHE="${srcdir}/gomodcache" \
    
      63    go test ./...
    
      64}
    
      65
    
      66package() {
    
      67  local source_root="${srcdir}/prolewatch-${pkgver}"
    
      68  local build_root="${srcdir}/prolewatch-build"
    
      69  local name
    
      70
    
      71  for name in prolewatch prolewatch-makepkg prolewatch-gpg prolewatch-net; do
    
      72    install -Dm0755 "${build_root}/${name}" "${pkgdir}/usr/bin/${name}"
    
      73  done
    
      74
    
      75  for name in default-config.yaml prolewatch.lua review-prompt.md verdict.schema.json; do
    
      76    install -Dm0644 "${source_root}/share/${name}" "${pkgdir}/usr/share/prolewatch/${name}"
    
      77  done
    
      78
    
      79  install -Dm0644 "${source_root}/share/default-config.yaml" "${pkgdir}/etc/prolewatch/config.yaml"
    
      80
    
      81  install -Dm0644 "${source_root}/README.md" "${pkgdir}/usr/share/doc/prolewatch/README.md"
    
      82  install -Dm0644 "${source_root}/SECURITY.md" "${pkgdir}/usr/share/doc/prolewatch/SECURITY.md"
    
      83  install -Dm0644 "${source_root}/docs/architecture.md" "${pkgdir}/usr/share/doc/prolewatch/architecture.md"
    
      84  install -Dm0644 "${source_root}/docs/ai-review.md" "${pkgdir}/usr/share/doc/prolewatch/docs/ai-review.md"
    
      85  install -Dm0644 "${source_root}/docs/man/prolewatch.1" "${pkgdir}/usr/share/man/man1/prolewatch.1"
    
      86  install -Dm0644 "${source_root}/docs/man/prolewatch-config.5" "${pkgdir}/usr/share/man/man5/prolewatch-config.5"
    
      87  install -Dm0644 "${source_root}/LICENSE" "${pkgdir}/usr/share/licenses/prolewatch/LICENSE"
    
      88  install -Dm0644 "${source_root}/THIRD_PARTY_NOTICES" "${pkgdir}/usr/share/licenses/prolewatch/THIRD_PARTY_NOTICES"
    
      89}
    
      90

Changes since previous scan

--- PKGBUILD @ 2026-09-26 00:12
+++ PKGBUILD @ 2026-09-27 00:07
@@ -1,8 +1,8 @@
 # Maintainer: Holger Heinz <79228197+holgerjh@users.noreply.github.com>
 
 pkgname=prolewatch
-pkgver=0.12.2
-pkgrel=2
+pkgver=0.12.4
+pkgrel=1
 pkgdesc='AUR security scanner and build sandbox with network isolation, optional AI review and root action inspection'
 arch=('x86_64')
 url='https://github.com/holgerjh/prolewatch'
@@ -23,7 +23,7 @@
 
 source=("prolewatch-${pkgver}.tar.gz::https://github.com/holgerjh/prolewatch/releases/download/v${pkgver}/prolewatch-${pkgver}.tar.gz"
         "prolewatch-${pkgver}.tar.gz.sig::https://github.com/holgerjh/prolewatch/releases/download/v${pkgver}/prolewatch-${pkgver}.tar.gz.sig")
-sha256sums=('7c68635800f823860f9dd828eafca9cfcd42a32f10ec5df524d1a26dcd88dca5'
+sha256sums=('d83da9a6830ca3f98f022dfd9b6c75840db742c712e2f160bbb12d87d4c90d44'
              'SKIP')
 validpgpkeys=('296E983E7120909958BD38E557F1F87148E02B27')
 
@@ -82,6 +82,8 @@
   install -Dm0644 "${source_root}/SECURITY.md" "${pkgdir}/usr/share/doc/prolewatch/SECURITY.md"
   install -Dm0644 "${source_root}/docs/architecture.md" "${pkgdir}/usr/share/doc/prolewatch/architecture.md"
   install -Dm0644 "${source_root}/docs/ai-review.md" "${pkgdir}/usr/share/doc/prolewatch/docs/ai-review.md"
+  install -Dm0644 "${source_root}/docs/man/prolewatch.1" "${pkgdir}/usr/share/man/man1/prolewatch.1"
+  install -Dm0644 "${source_root}/docs/man/prolewatch-config.5" "${pkgdir}/usr/share/man/man5/prolewatch-config.5"
   install -Dm0644 "${source_root}/LICENSE" "${pkgdir}/usr/share/licenses/prolewatch/LICENSE"
   install -Dm0644 "${source_root}/THIRD_PARTY_NOTICES" "${pkgdir}/usr/share/licenses/prolewatch/THIRD_PARTY_NOTICES"
 }

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-27 00:07:07	Clean	2
2026-09-26 13:15:17	Low	1
2026-09-26 00:12:15	Clean	2
2026-09-25 23:13:47	Low	1
2026-09-25 21:13:17	Low	1