radicle-httpd

LOW
maintainer intelfx 1 votes base radicle-explorer scanned 2026-08-21 00:01:35.148225
View on AUR
Why flagged

The source is a git checkout from the project's own domain (seed.radicle.dev), which is plausibly official; building from source is normal AUR packaging behavior, and no untrusted executables are downloaded or executed.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git checkout from the project's own domain (seed.radicle.dev), which is plausibly official; building from source is normal AUR packaging behavior, and no untrusted executables are downloaded or executed.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:24 "radicle-explorer::git+https://$_node/${_rid#rad:}.git#tag=$_tag"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Ivan Shapovalov <intelfx@intelfx.name>
2
3pkgbase=radicle-explorer
4pkgname=(radicle-{explorer,httpd})
5pkgver=0.27.0
6pkgrel=1
7pkgdesc="open source, peer-to-peer code collaboration stack built on Git"
8arch=('x86_64')
9license=('GPL-3.0-only' 'Apache-2.0 OR MIT')
10_node="seed.radicle.dev"
11_rid="rad:z4V1sjrXqjvFdnCUbxPFqd5p4DtH5"
12url="https://app.radicle.dev/nodes/$_node/$_rid"
13makedepends=(
14 'git'
15 'cargo'
16 'asciidoctor'
17 'nodejs'
18 'npm'
19 'pnpm'
20 'libgit2' 'libgit2.so'
21)
22_tag="releases/$pkgver"
23source=(
24 "radicle-explorer::git+https://$_node/${_rid#rad:}.git#tag=$_tag"
25 "radicle-explorer.config.json"
26 "radicle-explorer.nginx.conf"
27 "radicle-httpd.system.service"
28 "radicle-httpd.user.service"
29)
30b2sums=('533929c9927ea47d97353ffa7dde8d900041f848bcfab04a6eab57ddad9126451f3fc42f309edce234dc65f922cbb20a84a04e4249277c4b2938473f92d0e48e'
31 'd29bf8a4344d407cdc19cce3d6d8ef2f28e97454c07978301ef1009a995ba8f352ad706b7230f33d290d7b055d8a8c80c80164625463adc4e0b1191b1c4573f2'
32 '5735a8bae977e1fde93a294de1a7f738542f8c4d12d8efeed940c0a8f79f05a59c70101cf9faaa7207f034915e2ac189b0e4af7f0285610dbd9ecc0305d2601c'
33 '3171cadeeb285a5baa9eebef8383ba4963c618db540a2480e60f08c4639c8f8fd18e8c435bfdd0f704cc3dcafb81fa91e97c1e5825d0144a62b3e3a5b32ef295'
34 '75b438724669793478e4bfed2745c4e9c97e25f24863eabe2c0f7bbb72571bc6f572bc07092576678162a7c7cf1f861e2046a69f11bb1408597e1e98bbd5e2b6')
35
36prepare() {
37 cd radicle-explorer
38 pnpm import
39 pnpm install \
40 --shamefully-hoist \
41 --dangerously-allow-all-builds \
42 # EOL
43
44 cargo fetch --locked --target host-tuple
45}
46
47build() {
48 cd radicle-explorer
49 export VITE_RUNTIME_CONFIG=true
50 pnpm --config.verifyDepsBeforeRun=false \
51 build
52
53 # _Disable_ cross-toolchain LTO because we are using different toolchains
54 # for C/C++ and Rust code (i.e., LLVM LTO is incompatible with GCC LTO).
55 # In this project, C/C++ code is linked into Rust code. Therefore, apply
56 # a workaround to force generation of normal object code on C side:
57 CFLAGS+=" -ffat-lto-objects"
58 CXXFLAGS+=" -ffat-lto-objects"
59
60 export LIBGIT2_NO_VENDOR=1
61
62 export RADICLE_VERSION="$pkgver"
63 cargo build \
64 -p radicle-httpd \
65 -p radicle-search \
66 --frozen \
67 --release \
68 --bins \
69 # EOL
70
71 mkdir -p target/release/man
72 for _man in crates/*/*.adoc; do
73 asciidoctor --doctype manpage --backend manpage --destination-dir target/release/man "$_man"
74 done
75}
76
77check() {
78 cd radicle-explorer
79 (
80 # Ideally, we'd use `env -i`, but `cargo test` forces a recompilation
81 # if build flags don't match (+ we want to test what we ship anyway).
82 # As a stop-gap, unset variables that are known to break tests
83 # (and might have been set in makepkg.conf).
84 unset "${!GIT_@}"
85 cargo test \
86 -p radicle-httpd \
87 -p radicle-search \
88 --frozen \
89 # EOL
90 )
91}
92
93package_radicle-explorer() {
94 pkgdesc+=" - explorer (frontend)"
95 arch=(any)
96 license=('GPL-3.0-only')
97 depends=()
98 optdepends=(
99 'radicle-httpd: local backend for radicle-explorer'
100 )
101
102 cd radicle-explorer
103
104 install -dm755 \
105 "$pkgdir/usr/share/radicle-explorer"
106 cp -dR --preserve=timestamps \
107 build \
108 -T "$pkgdir/usr/share/radicle-explorer"
109 install -Dm644 \
110 config/default.json \
111 -T "$pkgdir/usr/share/radicle-explorer/config.json.example"
112 # TODO: install into /etc?
113 install -Dm644 \
114 "$srcdir/radicle-explorer.config.json" \
115 -T "$pkgdir/usr/share/radicle-explorer/config.json"
116
117 install -Dm644 \
118 LICENSE \
119 -t "$pkgdir/usr/share/licenses/$pkgname"
120}
121
122package_radicle-httpd() {
123 pkgdesc+=" - explorer (backend)"
124 license=('Apache-2.0 OR MIT')
125 depends=(
126 'glibc'
127 'libgcc' 'libgcc_s.so'
128 'libgit2' 'libgit2.so'
129 'radicle-node'
130 )
131
132 cd radicle-explorer
133
134 #
135 # TODO: proper radicle-search integration
136 #
137
138 install -Dm755 \
139 target/release/radicle-httpd \
140 target/release/radicle-search \
141 -t "$pkgdir/usr/bin"
142
143 install -Dm644 \
144 target/release/man/radicle-httpd.1 \
145 -t "$pkgdir/usr/share/man/man1"
146
147 install -Dm644 \
148 "$srcdir/radicle-httpd.system.service" \
149 "$pkgdir/usr/lib/systemd/system/radicle-httpd.service"
150 install -Dm644 \
151 "$srcdir/radicle-httpd.user.service" \
152 "$pkgdir/usr/lib/systemd/user/radicle-httpd.service"
153 install -Dm644 \
154 "$srcdir/radicle-explorer.nginx.conf" \
155 "$pkgdir/usr/share/doc/$pkgname/nginx/radicle-explorer.conf"
156
157 install -Dm644 \
158 crates/radicle-httpd/LICENSE-APACHE \
159 crates/radicle-httpd/LICENSE-MIT \
160 -t "$pkgdir/usr/share/licenses/$pkgname"
161}
162

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-21 00:01
@@ -2,14 +2,14 @@
pkgbase=radicle-explorer
pkgname=(radicle-{explorer,httpd})
-pkgver=0.25.0
+pkgver=0.27.0
pkgrel=1
pkgdesc="open source, peer-to-peer code collaboration stack built on Git"
arch=('x86_64')
license=('GPL-3.0-only' 'Apache-2.0 OR MIT')
-_node="seed.radicle.xyz"
+_node="seed.radicle.dev"
_rid="rad:z4V1sjrXqjvFdnCUbxPFqd5p4DtH5"
-url="https://app.radicle.xyz/nodes/$_node/$_rid"
+url="https://app.radicle.dev/nodes/$_node/$_rid"
makedepends=(
'git'
'cargo'
@@ -17,7 +17,7 @@
'nodejs'
'npm'
'pnpm'
- 'libgit2'
+ 'libgit2' 'libgit2.so'
)
_tag="releases/$pkgver"
source=(
@@ -27,7 +27,7 @@
"radicle-httpd.system.service"
"radicle-httpd.user.service"
)
-b2sums=('739f243a7d4af747a38fe753bf40457cef90dd57cb39ea828f6b29dcd1ca13a74c90cdd49c3ec80c98aef94b3567d5a48ec6494484d864aa0883e4fc413887ef'
+b2sums=('533929c9927ea47d97353ffa7dde8d900041f848bcfab04a6eab57ddad9126451f3fc42f309edce234dc65f922cbb20a84a04e4249277c4b2938473f92d0e48e'
'd29bf8a4344d407cdc19cce3d6d8ef2f28e97454c07978301ef1009a995ba8f352ad706b7230f33d290d7b055d8a8c80c80164625463adc4e0b1191b1c4573f2'
'5735a8bae977e1fde93a294de1a7f738542f8c4d12d8efeed940c0a8f79f05a59c70101cf9faaa7207f034915e2ac189b0e4af7f0285610dbd9ecc0305d2601c'
'3171cadeeb285a5baa9eebef8383ba4963c618db540a2480e60f08c4639c8f8fd18e8c435bfdd0f704cc3dcafb81fa91e97c1e5825d0144a62b3e3a5b32ef295'
@@ -41,8 +41,7 @@
--dangerously-allow-all-builds \
# EOL
- cd radicle-httpd
- cargo fetch --locked --target "$(rustc --print host-tuple)"
+ cargo fetch --locked --target host-tuple
}
build() {
@@ -60,25 +59,23 @@
export LIBGIT2_NO_VENDOR=1
- cd radicle-httpd
export RADICLE_VERSION="$pkgver"
cargo build \
+ -p radicle-httpd \
+ -p radicle-search \
--frozen \
--release \
--bins \
# EOL
mkdir -p target/release/man
- for _man in *.adoc; do
+ for _man in crates/*/*.adoc; do
asciidoctor --doctype manpage --backend manpage --destination-dir target/release/man "$_man"
done
-
- # XXX: tests rebuild and overwrite some of the binaries
- cp -a target/release -T target/dist
}
check() {
- cd radicle-explorer/radicle-httpd
+ cd radicle-explorer
(
# Ideally, we'd use `env -i`, but `cargo test` forces a recompilation
# if build flags don't match (+ we want to test what we ship anyway).
@@ -86,6 +83,8 @@
# (and might have been set in makepkg.conf).
unset "${!GIT_@}"
cargo test \
+ -p radicle-httpd \
+ -p radicle-search \
--frozen \
# EOL
)
@@ -93,6 +92,7 @@
package_radicle-explorer() {
pkgdesc+=" - explorer (frontend)"
+ arch=(any)
license=('GPL-3.0-only')
depends=()
optdepends=(
@@ -124,20 +124,24 @@
license=('Apache-2.0 OR MIT')
depends=(
'glibc'
- 'libgcc'
+ 'libgcc' 'libgcc_s.so'
'libgit2' 'libgit2.so'
- 'zlib'
'radicle-node'
)
- cd radicle-explorer/radicle-httpd
+ cd radicle-explorer
+
+ #
+ # TODO: proper radicle-search integration
+ #
install -Dm755 \
- target/dist/radicle-httpd \
+ target/release/radicle-httpd \
+ target/release/radicle-search \
-t "$pkgdir/usr/bin"
install -Dm644 \
- target/dist/man/radicle-httpd.1 \
+ target/release/man/radicle-httpd.1 \
-t "$pkgdir/usr/share/man/man1"
install -Dm644 \
@@ -151,8 +155,8 @@
"$pkgdir/usr/share/doc/$pkgname/nginx/radicle-explorer.conf"
install -Dm644 \
- LICENSE-APACHE \
- LICENSE-MIT \
+ crates/radicle-httpd/LICENSE-APACHE \
+ crates/radicle-httpd/LICENSE-MIT \
-t "$pkgdir/usr/share/licenses/$pkgname"
}

Scan history

Scanned at (UTC)SeverityRules
2026-08-21 00:01:35 Low 2
2026-08-20 23:13:41 Medium 1
2026-06-19 19:07:35 Clean 2
2026-06-18 18:55:24 Clean 2
2026-06-18 16:11:54 Medium 1

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion