radicle-httpd

LOW
maintainer intelfx 1 votes base radicle-explorer scanned 2026-10-05 00:08:03.938595
View on AUR
Why flagged

The source is a git checkout from the project's own domain (seed.radicle.dev), which is plausibly official; building from source is normal AUR packaging behavior, and no untrusted executables are downloaded or executed.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git checkout from the project's own domain (seed.radicle.dev), which is plausibly official; building from source is normal AUR packaging behavior, and no untrusted executables are downloaded or executed.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:24 "radicle-explorer::git+https://$_node/${_rid#rad:}.git#tag=$_tag"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Ivan Shapovalov <intelfx@intelfx.name>
2
3pkgbase=radicle-explorer
4pkgname=(radicle-{explorer,httpd})
5pkgver=0.27.0
6pkgrel=1
7pkgdesc="open source, peer-to-peer code collaboration stack built on Git"
8arch=('x86_64')
9license=('GPL-3.0-only' 'Apache-2.0 OR MIT')
10_node="seed.radicle.dev"
11_rid="rad:z4V1sjrXqjvFdnCUbxPFqd5p4DtH5"
12url="https://app.radicle.dev/nodes/$_node/$_rid"
13makedepends=(
14 'git'
15 'cargo'
16 'asciidoctor'
17 'nodejs'
18 'npm'
19 'pnpm'
20 'libgit2' 'libgit2.so'
21)
22_tag="releases/$pkgver"
23source=(
24 "radicle-explorer::git+https://$_node/${_rid#rad:}.git#tag=$_tag"
25 "radicle-explorer.config.json"
26 "radicle-explorer.nginx.conf"
27 "radicle-httpd.system.service"
28 "radicle-httpd.user.service"
29)
30b2sums=('533929c9927ea47d97353ffa7dde8d900041f848bcfab04a6eab57ddad9126451f3fc42f309edce234dc65f922cbb20a84a04e4249277c4b2938473f92d0e48e'
31 'd29bf8a4344d407cdc19cce3d6d8ef2f28e97454c07978301ef1009a995ba8f352ad706b7230f33d290d7b055d8a8c80c80164625463adc4e0b1191b1c4573f2'
32 '5735a8bae977e1fde93a294de1a7f738542f8c4d12d8efeed940c0a8f79f05a59c70101cf9faaa7207f034915e2ac189b0e4af7f0285610dbd9ecc0305d2601c'
33 '3171cadeeb285a5baa9eebef8383ba4963c618db540a2480e60f08c4639c8f8fd18e8c435bfdd0f704cc3dcafb81fa91e97c1e5825d0144a62b3e3a5b32ef295'
34 '75b438724669793478e4bfed2745c4e9c97e25f24863eabe2c0f7bbb72571bc6f572bc07092576678162a7c7cf1f861e2046a69f11bb1408597e1e98bbd5e2b6')
35
36prepare() {
37 cd radicle-explorer
38 pnpm import
39 pnpm install \
40 --shamefully-hoist \
41 --dangerously-allow-all-builds \
42 # EOL
43
44 cargo fetch --locked --target host-tuple
45}
46
47build() {
48 cd radicle-explorer
49 export VITE_RUNTIME_CONFIG=true
50 pnpm --config.verifyDepsBeforeRun=false \
51 build
52
53 # _Disable_ cross-toolchain LTO because we are using different toolchains
54 # for C/C++ and Rust code (i.e., LLVM LTO is incompatible with GCC LTO).
55 # In this project, C/C++ code is linked into Rust code. Therefore, apply
56 # a workaround to force generation of normal object code on C side:
57 CFLAGS+=" -ffat-lto-objects"
58 CXXFLAGS+=" -ffat-lto-objects"
59
60 export LIBGIT2_NO_VENDOR=1
61
62 export RADICLE_VERSION="$pkgver"
63 cargo build \
64 -p radicle-httpd \
65 -p radicle-search \
66 --frozen \
67 --release \
68 --bins \
69 # EOL
70
71 mkdir -p target/release/man
72 for _man in crates/*/*.adoc; do
73 asciidoctor --doctype manpage --backend manpage --destination-dir target/release/man "$_man"
74 done
75}
76
77check() {
78 cd radicle-explorer
79 (
80 # Ideally, we'd use `env -i`, but `cargo test` forces a recompilation
81 # if build flags don't match (+ we want to test what we ship anyway).
82 # As a stop-gap, unset variables that are known to break tests
83 # (and might have been set in makepkg.conf).
84 unset "${!GIT_@}"
85 cargo test \
86 -p radicle-httpd \
87 -p radicle-search \
88 --frozen \
89 # EOL
90 )
91}
92
93package_radicle-explorer() {
94 pkgdesc+=" - explorer (frontend)"
95 arch=(any)
96 license=('GPL-3.0-only')
97 depends=()
98 optdepends=(
99 'radicle-httpd: local backend for radicle-explorer'
100 )
101
102 cd radicle-explorer
103
104 install -dm755 \
105 "$pkgdir/usr/share/radicle-explorer"
106 cp -dR --preserve=timestamps \
107 build \
108 -T "$pkgdir/usr/share/radicle-explorer"
109 install -Dm644 \
110 config/default.json \
111 -T "$pkgdir/usr/share/radicle-explorer/config.json.example"
112 # TODO: install into /etc?
113 install -Dm644 \
114 "$srcdir/radicle-explorer.config.json" \
115 -T "$pkgdir/usr/share/radicle-explorer/config.json"
116
117 install -Dm644 \
118 LICENSE \
119 -t "$pkgdir/usr/share/licenses/$pkgname"
120}
121
122package_radicle-httpd() {
123 pkgdesc+=" - explorer (backend)"
124 license=('Apache-2.0 OR MIT')
125 depends=(
126 'glibc'
127 'libgcc' 'libgcc_s.so'
128 'libgit2' 'libgit2.so'
129 'radicle-node'
130 )
131
132 cd radicle-explorer
133
134 #
135 # TODO: proper radicle-search integration
136 #
137
138 install -Dm755 \
139 target/release/radicle-httpd \
140 target/release/radicle-search \
141 -t "$pkgdir/usr/bin"
142
143 install -Dm644 \
144 target/release/man/radicle-httpd.1 \
145 -t "$pkgdir/usr/share/man/man1"
146
147 install -Dm644 \
148 "$srcdir/radicle-httpd.system.service" \
149 "$pkgdir/usr/lib/systemd/system/radicle-httpd.service"
150 install -Dm644 \
151 "$srcdir/radicle-httpd.user.service" \
152 "$pkgdir/usr/lib/systemd/user/radicle-httpd.service"
153 install -Dm644 \
154 "$srcdir/radicle-explorer.nginx.conf" \
155 "$pkgdir/usr/share/doc/$pkgname/nginx/radicle-explorer.conf"
156
157 install -Dm644 \
158 crates/radicle-httpd/LICENSE-APACHE \
159 crates/radicle-httpd/LICENSE-MIT \
160 -t "$pkgdir/usr/share/licenses/$pkgname"
161}
162

Scan history

Scanned at (UTC)SeverityRules
2026-10-05 00:08:03 Low 2
2026-10-04 00:18:08 Low 2
2026-10-03 00:23:04 Low 2
2026-10-02 00:00:32 Low 2
2026-10-01 00:02:06 Low 2
2026-09-30 00:20:07 Low 2
2026-09-29 00:07:46 Low 2
2026-09-28 00:28:32 Low 2
2026-09-27 00:07:07 Low 2
2026-09-26 00:12:15 Low 2
2026-09-25 00:03:36 Low 2
2026-09-24 00:24:14 Low 2
2026-09-23 00:28:13 Low 2
2026-09-22 00:15:14 Low 2
2026-09-21 00:26:32 Low 2
2026-09-20 00:25:31 Low 2
2026-09-19 00:25:36 Low 2
2026-09-18 00:17:11 Low 2
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion