rabbitmq-client-git

maintainer Kaleidox · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged Builds from the project's own git repository on a personal/self-hosted forge (git.comroid.org), which is normal AUR packaging; the only concerns are the non-whitelisted host and SKIP'd checksum, but this is the project's own source being compiled, not an unverifiable prebuilt binary from an unrelated party.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Builds from the project's own git repository on a personal/self-hosted forge (git.comroid.org), which is normal AUR packaging; the only concerns are the non-whitelisted host and SKIP'd checksum, but this is the project's own source being compiled, not an unverifiable prebuilt binary from an unrelated party.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("git+https://git.comroid.org/comroid/rabbitmq-client.git")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kaley Burdow <kaleidox@comroid.org>
    
      2
    
      3pkgname=rabbitmq-client-git
    
      4pkgver=0.1
    
      5pkgrel=1
    
      6pkgdesc="CLI RabbitMQ client"
    
      7arch=('any')
    
      8url="https://git.comroid.org/comroid/rabbitmq-client"
    
      9license=('GPL-3.0')
    
      10depends=('dotnet-runtime-10.0')
    
      11makedepends=('dotnet-sdk-10.0')
    
      12source=("git+https://git.comroid.org/comroid/rabbitmq-client.git")
    
      13md5sums=('SKIP')
    
      14options+=("!strip")
    
      15
    
      16build() {
    
      17    cd rabbitmq-client
    
      18    dotnet publish -c Release --use-current-runtime
    
      19}
    
      20
    
      21package() {
    
      22    install -Dm755 "rabbitmq-client/rabbitmq-client/bin/Release/net10.0/linux-x64/publish/rabbitmq-client" "$pkgdir/usr/bin/rabbitmq-client"
    
      23}
    
      24

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 15:15:49	LOW	3
2026-07-20 15:14:11	MEDIUM	2