pvs-studio

MEDIUM

maintainer lapsus 18 votes scanned 2026-09-13 19:15:06.142757

View on AUR

Why flagged

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("${_name}.tgz::https://files.${pkgname}.com/${_name}.tgz")

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yakov Till <yakov.till@gmail.com>
    
      2# Contributor: Razykov Vyacheslav <v.razykov@gmail.com>
    
      3# Contributor: Marat Moustafine <moustafine-@t-tuta-d.t-io>
    
      4
    
      5pkgname=pvs-studio
    
      6pkgver=8.00.109087.832
    
      7pkgrel=1
    
      8pkgdesc='Static code analyzer for C and C++'
    
      9arch=('x86_64')
    
      10url='https://pvs-studio.com/en/pvs-studio/'
    
      11license=('LicenseRef-pvs-studio')
    
      12optdepends=('bash-completion: for bash completion'
    
      13            'strace: for pvs-studio-analyzer trace')
    
      14conflicts=("${pkgname}-bin")
    
      15options=('!debug')
    
      16_name=${pkgname}-${pkgver}-x86_64
    
      17source=("${_name}.tgz::https://files.${pkgname}.com/${_name}.tgz")
    
      18sha256sums=('b136ccfcbefb4da9aae1220340ea1a30219a14478a699a168bb16b680a656368')
    
      19
    
      20latestver() {
    
      21  local html ver
    
      22  html=$(curl -fsSL -H 'User-Agent: Mozilla/5.0' \
    
      23    'https://pvs-studio.com/en/pvs-studio/download-all/') || return 1
    
      24  ver=$(sed -n "s/.*pvs-studio-\([0-9.]\{1,\}\)-x86_64\\.tgz.*/\\1/p" <<< "$html" |
    
      25    head -n1)
    
      26  if [[ -z $ver ]]; then
    
      27    printf 'Unable to determine latest PVS-Studio version\n' >&2
    
      28    return 1
    
      29  fi
    
      30  printf '%s\n' "$ver"
    
      31}
    
      32
    
      33package() {
    
      34  # static ELF executables: makepkg's inherited strip only runs --strip-debug on
    
      35  # them (a no-op, no DWARF present); --strip-unneeded removes .symtab/.strtab,
    
      36  # verified behavior-identical
    
      37  strip --strip-unneeded bin/*
    
      38
    
      39  install -Dm755 -t "${pkgdir}/usr/bin" bin/*
    
      40
    
      41  install -Dm644 "etc/bash_completion.d/${pkgname}.sh" \
    
      42    "${pkgdir}/usr/share/bash-completion/completions/plog-converter"
    
      43  ln -s plog-converter \
    
      44    "${pkgdir}/usr/share/bash-completion/completions/${pkgname}-analyzer"
    
      45
    
      46  install -Dm644 "share/doc/${pkgname}/LICENSE" \
    
      47    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      48}
    
      49

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-09-13 19:15
@@ -1,35 +1,49 @@
-# Maintainer: Razykov Vyacheslav <v.razykov@gmail.com>
+# Maintainer: Yakov Till <yakov.till@gmail.com>
+# Contributor: Razykov Vyacheslav <v.razykov@gmail.com>
 # Contributor: Marat Moustafine <moustafine-@t-tuta-d.t-io>
 
 pkgname=pvs-studio
-pkgver=7.41.103683.741
+pkgver=8.00.109087.832
 pkgrel=1
 pkgdesc='Static code analyzer for C and C++'
 arch=('x86_64')
-url=http://www.${pkgname}.com/en/${pkgname}
-license=('custom:pvs-studio')
-optdepends=('how-to-use-pvs-studio-free: for adding special comments to a source code'
-            'bash-completion: for bash completion'
-            'strace: for analyzing via using strace logs')
-conflicts=("$pkgname-bin")
-options=('!strip' '!debug')
+url='https://pvs-studio.com/en/pvs-studio/'
+license=('LicenseRef-pvs-studio')
+optdepends=('bash-completion: for bash completion'
+            'strace: for pvs-studio-analyzer trace')
+conflicts=("${pkgname}-bin")
+options=('!debug')
 _name=${pkgname}-${pkgver}-x86_64
-source=(${_name}.tgz::https://files.${pkgname}.com/${_name}.tgz)
-sha256sums=('ac8bf4a5a90f1ad27698667573dc9247b75aa82edc1c7d097bead51609baecae')
+source=("${_name}.tgz::https://files.${pkgname}.com/${_name}.tgz")
+sha256sums=('b136ccfcbefb4da9aae1220340ea1a30219a14478a699a168bb16b680a656368')
+
+latestver() {
+  local html ver
+  html=$(curl -fsSL -H 'User-Agent: Mozilla/5.0' \
+    'https://pvs-studio.com/en/pvs-studio/download-all/') || return 1
+  ver=$(sed -n "s/.*pvs-studio-\([0-9.]\{1,\}\)-x86_64\\.tgz.*/\\1/p" <<< "$html" |
+    head -n1)
+  if [[ -z $ver ]]; then
+    printf 'Unable to determine latest PVS-Studio version\n' >&2
+    return 1
+  fi
+  printf '%s\n' "$ver"
+}
 
 package() {
-  # PVS-Studio
-  install -Dm755 -t ${pkgdir}/usr/bin \
-    ${_name}/bin/${pkgname} \
-    ${_name}/bin/${pkgname}-analyzer \
-    ${_name}/bin/plog-converter
+  # static ELF executables: makepkg's inherited strip only runs --strip-debug on
+  # them (a no-op, no DWARF present); --strip-unneeded removes .symtab/.strtab,
+  # verified behavior-identical
+  strip --strip-unneeded bin/*
 
-  # Bash completion
-  install -Dm644 ${_name}/etc/bash_completion.d/${pkgname}.sh \
-                 ${pkgdir}/etc/bash_completion.d/${pkgname}.sh
+  install -Dm755 -t "${pkgdir}/usr/bin" bin/*
 
-  # License
-  install -Dm644 ${_name}/share/doc/${pkgname}/License.txt \
-                "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
+  install -Dm644 "etc/bash_completion.d/${pkgname}.sh" \
+    "${pkgdir}/usr/share/bash-completion/completions/plog-converter"
+  ln -s plog-converter \
+    "${pkgdir}/usr/share/bash-completion/completions/${pkgname}-analyzer"
+
+  install -Dm644 "share/doc/${pkgname}/LICENSE" \
+    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-13 19:15:06	Medium	2
2026-06-19 19:07:35	Clean	2
2026-06-18 16:11:54	Medium	1