publii

maintainer JulianXhokaxhiu · 10 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt RPM from a non-whitelisted host (getpublii.com), which is not a standard code hosting platform, posing a supply-chain risk if the host or package were compromised.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:9 source=("https://getpublii.com/download/Publii-$pkgver.rpm")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt RPM from a non-whitelisted host (getpublii.com), which is not a standard code hosting platform, posing a supply-chain risk if the host or package were compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Julian Xhokaxhiu <info at julianxhokaxhiu dot com>
    
      2pkgname=publii
    
      3pkgver=0.47.9
    
      4pkgrel=1
    
      5pkgdesc="Publii is a desktop-based CMS for Windows, Mac and Linux that makes creating static websites fast and hassle-free, even for beginners"
    
      6arch=('x86_64')
    
      7url="https://github.com/GetPublii/Publii"
    
      8license=('MIT')
    
      9source=("https://getpublii.com/download/Publii-$pkgver.rpm")
    
      10sha512sums=('d4861a070e67aed210e05a0dfc3cdebbf80c896e5b3d7f5ae56b8879cd8ee610096a387f7ce674d798018feff5e113c1e84800d0ce3d123cdda077ffb68906b6')
    
      11
    
      12package() {
    
      13  bsdtar -xpf "${srcdir}/Publii-$pkgver.rpm" -C $pkgdir
    
      14  [ -d $pkgdir/usr/lib/.build-id ] && rm -rf $pkgdir/usr/lib/.build-id
    
      15}
    
      16

Changes since previous scan

--- PKGBUILD @ 2026-06-20 16:03
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,13 +1,13 @@
 # Maintainer: Julian Xhokaxhiu <info at julianxhokaxhiu dot com>
 pkgname=publii
-pkgver=0.47.5
+pkgver=0.47.9
 pkgrel=1
 pkgdesc="Publii is a desktop-based CMS for Windows, Mac and Linux that makes creating static websites fast and hassle-free, even for beginners"
 arch=('x86_64')
 url="https://github.com/GetPublii/Publii"
 license=('MIT')
 source=("https://getpublii.com/download/Publii-$pkgver.rpm")
-sha512sums=('7d16d21ddd815d1365de338322faa442b203200b2100cf0fa290eb75cd179f879012d00ff7dfdf59fa6f67c9f5cb6787566024604e76d4bb270a25309f1aae8f')
+sha512sums=('d4861a070e67aed210e05a0dfc3cdebbf80c896e5b3d7f5ae56b8879cd8ee610096a387f7ce674d798018feff5e113c1e84800d0ce3d123cdda077ffb68906b6')
 
 package() {
   bsdtar -xpf "${srcdir}/Publii-$pkgver.rpm" -C $pkgdir

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 21:12:47	MEDIUM	2
2026-06-20 16:03:41	CLEAN	2
2026-06-20 00:50:07	MEDIUM	2
2026-06-20 00:18:46	MEDIUM	2
2026-06-19 23:51:18	MEDIUM	2
2026-06-19 19:07:35	MEDIUM	2
2026-06-18 16:11:54	MEDIUM	1