radicle-cli-git
LOW
maintainer intelfx
2 votes
base
radicle-git
scanned 2026-10-05 00:08:03.938595
Why flagged
The source is a git repository from a project-owned domain (seed.radicle.dev) used to build the software from source, which is a normal and safe AUR practice even if the host is not on a whitelist.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git repository from a project-owned domain (seed.radicle.dev) used to build the software from source, which is a normal and safe AUR practice even if the host is not on a whitelist.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:24
"heartwood::git+https://$_node/${_rid#rad:}.git"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Ivan Shapovalov <intelfx@intelfx.name>
2
3
pkgbase=radicle-git
4
pkgname=(radicle-{cli,node}-git)
5
pkgver=1.10.1.r8.gea66c657d
6
pkgrel=1
7
pkgdesc="open source, peer-to-peer code collaboration stack built on Git"
8
arch=('x86_64')
9
license=('Apache-2.0 OR MIT')
10
_node="seed.radicle.dev"
11
_rid="rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5"
12
url="https://radicle.dev"
13
depends=(
14
'glibc'
15
'libgcc' 'libgcc_s.so'
16
'libgit2' 'libgit2.so'
17
)
18
makedepends=(
19
'git'
20
'cargo'
21
'asciidoctor'
22
)
23
source=(
24
"heartwood::git+https://$_node/${_rid#rad:}.git"
25
"0001-build-work-around-sccache-do-not-read-SOURCE_DATE_EP.patch"
26
"radicle-node.system."{service,socket}
27
"radicle-node.user."{service,socket}
28
"radicle-node.dnssd"
29
)
30
b2sums=('SKIP'
31
'864190b259d2269ca412d11ca3998a2e35cdce72cd0b9127cda7788ad63ede1d8196a55aaf9df9b91805c6546d0dae81522dd2bb615aa787454687516e914086'
32
'14d3033ff232682b35d3f3a94436b86ad57f3be767e4681c18d1a8a4435968c31e0c36b5b617734035e75be144c99db7447be70741430962c614f0c17a59fecd'
33
'ef60f99e65177accd1b34447dab134ad26b576050ff15c9bfd6483bacaef801106a6ff5694383b7446b366818b1545c6506ccd6d1b153532b99b15361ddd8e41'
34
'18ade1de3d3195e8b4cfcb0c479d2f597b53cbb83bde559d69abd34587c8c45371c12e242621c92607c3202f2f4ee3fb21b462fc5150939f50744cc045baccff'
35
'46872e0bd50bbf1528321de5522a9af95227fe43f7880db50968cfd1572a719bd55b874f56f55cd5d4e653565504799d1e54ac16cabe29f65a08089985fdaa27'
36
'0276bce489e05115e7a63454aa0fa508d7bffba2add4249d1fcd449137104bc75882f5ff06077216fec5cbede5f2a1f8699e82bbc3fda3bf3b2354dfcf5dd0ac')
37
38
pkgver() {
39
cd heartwood
40
git describe --long --tags | sed -r 's#releases/##; s/^v//; s/-rc\./rc/; s/[^-]*-g/r&/; s/-/./g'
41
}
42
43
prepare() {
44
cd heartwood
45
46
# work around sccache brokenness around $SOURCE_DATE_EPOCH
47
git apply -3 "$srcdir/0001-build-work-around-sccache-do-not-read-SOURCE_DATE_EP.patch"
48
49
cargo fetch --locked --target host-tuple
50
}
51
52
build() {
53
cd heartwood
54
55
# Some crates seem to hardcode or prefer clang; undo that
56
export CC="${CC-gcc}"
57
export CXX="${CXX-g++}"
58
59
# _Disable_ cross-toolchain LTO because we are using different toolchains
60
# for C/C++ and Rust code (i.e., LLVM LTO is incompatible with GCC LTO).
61
# In this project, C/C++ code is linked into Rust code. Therefore, apply
62
# a workaround to force generation of normal object code on C side:
63
CFLAGS+=" -ffat-lto-objects"
64
CXXFLAGS+=" -ffat-lto-objects"
65
66
export LIBGIT2_NO_VENDOR=1
67
68
export RADICLE_VERSION="$pkgver"
69
cargo build \
70
-p radicle-cli \
71
-p radicle-node \
72
-p radicle-remote-helper \
73
--frozen \
74
--release \
75
--bins \
76
# EOL
77
78
mkdir -p target/release/man
79
scripts/build-man-pages.sh target/release/man *.adoc
80
}
81
82
check() {
83
local _test_skips=(
84
# https://radicle.zulipchat.com/#narrow/stream/369277-heartwood/topic/Flaky.20tests/near/438352360
85
"tests::e2e::test_connection_crossing"
86
# https://radicle.zulipchat.com/#narrow/stream/369277-heartwood/topic/Clone.20Partial.20Fail.20Flake
87
rad_clone_partial_fail
88
# this test seems flaky
89
rad_init_sync_preferred
90
)
91
92
cd heartwood
93
(
94
# Ideally, we'd use `env -i`, but `cargo test` forces a recompilation
95
# if build flags don't match (+ we want to test what we ship anyway).
96
# As a stop-gap, unset variables that are known to break tests
97
# (and might have been set in makepkg.conf).
98
unset "${!GIT_@}"
99
# Tests fail with ENFILE, crank it up to eleven
100
ulimit -n hard
101
# Tests require the newly built tools, add them to $PATH
102
PATH="$PWD/target/release:$PATH"
103
cargo test \
104
--frozen \
105
-- \
106
"${_test_skips[@]/#/--skip=}" \
107
# EOL
108
)
109
}
110
111
package_radicle-node-git() {
112
pkgdesc+=" - node"
113
provides=('radicle-node')
114
conflicts=('radicle-node')
115
116
cd heartwood
117
install -Dm755 \
118
target/release/radicle-node \
119
-t "$pkgdir/usr/bin"
120
121
install -Dm644 \
122
target/release/man/radicle-node.1 \
123
-t "$pkgdir/usr/share/man/man1"
124
125
for _t in service socket; do
126
install -Dm644 \
127
"$srcdir/radicle-node.system.$_t" \
128
"$pkgdir/usr/lib/systemd/system/radicle-node.$_t"
129
install -Dm644 \
130
"$srcdir/radicle-node.user.$_t" \
131
"$pkgdir/usr/lib/systemd/user/radicle-node.$_t"
132
done
133
install -Dm644 \
134
"$srcdir/radicle-node.dnssd" \
135
-t "$pkgdir/usr/share/doc/$pkgname/systemd"
136
137
install -Dm644 \
138
LICENSE-MIT \
139
LICENSE-APACHE \
140
-t "$pkgdir/usr/share/licenses/$pkgname"
141
}
142
143
package_radicle-cli-git() {
144
pkgdesc+=" - cli"
145
provides=('radicle-cli')
146
conflicts=('radicle-cli')
147
148
cd heartwood
149
150
install -Dm755 \
151
target/release/rad \
152
target/release/git-remote-rad \
153
-t "$pkgdir/usr/bin"
154
155
install -Dm644 \
156
target/release/man/rad.1 \
157
target/release/man/rad-*.1 \
158
target/release/man/git-remote-rad.1 \
159
-t "$pkgdir/usr/share/man/man1"
160
161
# Completions
162
"${pkgdir}/usr/bin/rad" completion bash \
163
| install -Dm644 /dev/stdin "${pkgdir}/usr/share/bash-completion/completions/rad"
164
"${pkgdir}/usr/bin/rad" completion zsh \
165
| install -Dm644 /dev/stdin "${pkgdir}/usr/share/zsh/site-functions/_rad"
166
"${pkgdir}/usr/bin/rad" completion fish \
167
| install -Dm644 /dev/stdin "${pkgdir}/usr/share/fish/vendor_completions.d/rad.fish"
168
169
install -Dm644 \
170
LICENSE-MIT \
171
-t "$pkgdir/usr/share/licenses/$pkgname"
172
}
173
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-05 00:08:03 | Low | 2 |
| 2026-10-04 00:18:08 | Low | 2 |
| 2026-10-03 00:23:04 | Low | 2 |
| 2026-10-02 00:00:32 | Low | 2 |
| 2026-10-01 00:02:06 | Low | 2 |
| 2026-09-30 00:20:07 | Low | 2 |
| 2026-09-29 00:07:46 | Low | 2 |
| 2026-09-28 00:28:32 | Low | 2 |
| 2026-09-27 00:07:07 | Low | 2 |
| 2026-09-26 00:12:15 | Low | 2 |
| 2026-09-25 00:03:36 | Low | 2 |
| 2026-09-24 00:24:14 | Low | 2 |
| 2026-09-23 00:28:13 | Low | 2 |
| 2026-09-22 00:15:14 | Low | 2 |
| 2026-09-21 00:26:32 | Low | 2 |
| 2026-09-20 00:25:31 | Low | 2 |
| 2026-09-19 00:25:36 | Low | 2 |
| 2026-09-18 00:17:11 | Low | 2 |
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |