radicle-httpd-git

LOW
maintainer intelfx 1 votes base radicle-explorer-git scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The source is a git checkout from the project's own domain (seed.radicle.dev), which is plausibly the official infrastructure; building from source is normal for AUR packages, and no unverifiable or executable payloads are downloaded.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git checkout from the project's own domain (seed.radicle.dev), which is plausibly the official infrastructure; building from source is normal for AUR packages, and no unverifiable or executable payloads are downloaded.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:23 "radicle-explorer::git+https://$_node/${_rid#rad:}.git"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Ivan Shapovalov <intelfx@intelfx.name>
2
3pkgbase=radicle-explorer-git
4pkgname=(radicle-{explorer,httpd}-git)
5pkgver=0.27.0.r2.gab514fe0d
6pkgrel=1
7pkgdesc="open source, peer-to-peer code collaboration stack built on Git"
8arch=('x86_64')
9license=('GPL-3.0-only' 'Apache-2.0 OR MIT')
10_node="seed.radicle.dev"
11_rid="rad:z4V1sjrXqjvFdnCUbxPFqd5p4DtH5"
12url="https://app.radicle.dev/nodes/$_node/$_rid"
13makedepends=(
14 'git'
15 'cargo'
16 'asciidoctor'
17 'nodejs'
18 'npm'
19 'pnpm'
20 'libgit2' 'libgit2.so'
21)
22source=(
23 "radicle-explorer::git+https://$_node/${_rid#rad:}.git"
24 "radicle-explorer.config.json"
25 "radicle-explorer.nginx.conf"
26 "radicle-httpd.system.service"
27 "radicle-httpd.user.service"
28)
29b2sums=('SKIP'
30 'd29bf8a4344d407cdc19cce3d6d8ef2f28e97454c07978301ef1009a995ba8f352ad706b7230f33d290d7b055d8a8c80c80164625463adc4e0b1191b1c4573f2'
31 '5735a8bae977e1fde93a294de1a7f738542f8c4d12d8efeed940c0a8f79f05a59c70101cf9faaa7207f034915e2ac189b0e4af7f0285610dbd9ecc0305d2601c'
32 '3171cadeeb285a5baa9eebef8383ba4963c618db540a2480e60f08c4639c8f8fd18e8c435bfdd0f704cc3dcafb81fa91e97c1e5825d0144a62b3e3a5b32ef295'
33 '75b438724669793478e4bfed2745c4e9c97e25f24863eabe2c0f7bbb72571bc6f572bc07092576678162a7c7cf1f861e2046a69f11bb1408597e1e98bbd5e2b6')
34
35pkgver() {
36 cd radicle-explorer
37 git describe --long --tags | sed -r 's#^releases/##; s/^v//; s/-rc\./rc/; s/[^-]*-g/r&/; s/-/./g'
38}
39
40prepare() {
41 cd radicle-explorer
42 pnpm import
43 pnpm install \
44 --dangerously-allow-all-builds \
45 --shamefully-hoist \
46 # EOL
47
48 cargo fetch --locked --target host-tuple
49}
50
51build() {
52 cd radicle-explorer
53 export VITE_RUNTIME_CONFIG=true
54 pnpm --config.verifyDepsBeforeRun=false \
55 build
56
57 # _Disable_ cross-toolchain LTO because we are using different toolchains
58 # for C/C++ and Rust code (i.e., LLVM LTO is incompatible with GCC LTO).
59 # In this project, C/C++ code is linked into Rust code. Therefore, apply
60 # a workaround to force generation of normal object code on C side:
61 CFLAGS+=" -ffat-lto-objects"
62 CXXFLAGS+=" -ffat-lto-objects"
63
64 export LIBGIT2_NO_VENDOR=1
65 export RADICLE_VERSION="$pkgver"
66 cargo build \
67 -p radicle-httpd \
68 -p radicle-search \
69 --frozen \
70 --release \
71 --bins \
72 # EOL
73
74 mkdir -p target/release/man
75 for _man in crates/*/*.adoc; do
76 asciidoctor --doctype manpage --backend manpage --destination-dir target/release/man "$_man"
77 done
78}
79
80check() {
81 cd radicle-explorer
82 (
83 # Ideally, we'd use `env -i`, but `cargo test` forces a recompilation
84 # if build flags don't match (+ we want to test what we ship anyway).
85 # As a stop-gap, unset variables that are known to break tests
86 # (and might have been set in makepkg.conf).
87 unset "${!GIT_@}"
88 cargo test \
89 -p radicle-httpd \
90 -p radicle-search \
91 --frozen \
92 # EOL
93 )
94}
95
96package_radicle-explorer-git() {
97 pkgdesc+=" - explorer (frontend)"
98 arch=(any)
99 license=('GPL-3.0-only')
100 depends=()
101 optdepends=(
102 'radicle-httpd: local backend for radicle-explorer'
103 )
104 provides=('radicle-explorer')
105 conflicts=('radicle-explorer')
106
107 cd radicle-explorer
108
109 install -dm755 \
110 "$pkgdir/usr/share/radicle-explorer"
111 cp -dR --preserve=timestamps \
112 build \
113 -T "$pkgdir/usr/share/radicle-explorer"
114 install -Dm644 \
115 config/default.json \
116 -T "$pkgdir/usr/share/radicle-explorer/config.json.example"
117 # TODO: install into /etc?
118 install -Dm644 \
119 "$srcdir/radicle-explorer.config.json" \
120 -T "$pkgdir/usr/share/radicle-explorer/config.json"
121
122 install -Dm644 \
123 LICENSE \
124 -t "$pkgdir/usr/share/licenses/$pkgname"
125}
126
127package_radicle-httpd-git() {
128 pkgdesc+=" - explorer (backend)"
129 license=('Apache-2.0 OR MIT')
130 depends=(
131 'glibc'
132 'libgcc' 'libgcc_s.so'
133 'libgit2' 'libgit2.so'
134 'radicle-node'
135 )
136 provides=('radicle-httpd')
137 conflicts=('radicle-httpd')
138
139 cd radicle-explorer
140
141 #
142 # TODO: proper radicle-search integration
143 #
144
145 install -Dm755 \
146 target/release/radicle-httpd \
147 target/release/radicle-search \
148 -t "$pkgdir/usr/bin"
149
150 install -Dm644 \
151 target/release/man/radicle-httpd.1 \
152 -t "$pkgdir/usr/share/man/man1"
153
154 install -Dm644 \
155 "$srcdir/radicle-httpd.system.service" \
156 "$pkgdir/usr/lib/systemd/system/radicle-httpd.service"
157 install -Dm644 \
158 "$srcdir/radicle-httpd.user.service" \
159 "$pkgdir/usr/lib/systemd/user/radicle-httpd.service"
160 install -Dm644 \
161 "$srcdir/radicle-explorer.nginx.conf" \
162 "$pkgdir/usr/share/doc/$pkgname/nginx/radicle-explorer.conf"
163
164 install -Dm644 \
165 crates/radicle-httpd/LICENSE-APACHE \
166 crates/radicle-httpd/LICENSE-MIT \
167 -t "$pkgdir/usr/share/licenses/$pkgname"
168}
169

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion