radicle-httpd-git

maintainer intelfx · 1 votes · base radicle-explorer-git · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a git repository from a domain associated with the project (radicle.xyz), building from official project source, which is normal for AUR packages despite the non-standard host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git repository from a domain associated with the project (radicle.xyz), building from official project source, which is normal for AUR packages despite the non-standard host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 "radicle-explorer::git+https://$_node/${_rid#rad:}.git"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ivan Shapovalov <intelfx@intelfx.name>
    
      2
    
      3pkgbase=radicle-explorer-git
    
      4pkgname=(radicle-{explorer,httpd}-git)
    
      5pkgver=0.26.0.r2.g3c2935704
    
      6pkgrel=1
    
      7pkgdesc="open source, peer-to-peer code collaboration stack built on Git"
    
      8arch=('x86_64')
    
      9license=('GPL-3.0-only' 'Apache-2.0 OR MIT')
    
      10_node="seed.radicle.xyz"
    
      11_rid="rad:z4V1sjrXqjvFdnCUbxPFqd5p4DtH5"
    
      12url="https://app.radicle.xyz/nodes/$_node/$_rid"
    
      13makedepends=(
    
      14	'git'
    
      15	'cargo'
    
      16	'asciidoctor'
    
      17	'nodejs'
    
      18	'npm'
    
      19	'pnpm'
    
      20	'libgit2'
    
      21)
    
      22source=(
    
      23	"radicle-explorer::git+https://$_node/${_rid#rad:}.git"
    
      24	"radicle-explorer.config.json"
    
      25	"radicle-explorer.nginx.conf"
    
      26	"radicle-httpd.system.service"
    
      27	"radicle-httpd.user.service"
    
      28)
    
      29b2sums=('SKIP'
    
      30        'd29bf8a4344d407cdc19cce3d6d8ef2f28e97454c07978301ef1009a995ba8f352ad706b7230f33d290d7b055d8a8c80c80164625463adc4e0b1191b1c4573f2'
    
      31        '5735a8bae977e1fde93a294de1a7f738542f8c4d12d8efeed940c0a8f79f05a59c70101cf9faaa7207f034915e2ac189b0e4af7f0285610dbd9ecc0305d2601c'
    
      32        '3171cadeeb285a5baa9eebef8383ba4963c618db540a2480e60f08c4639c8f8fd18e8c435bfdd0f704cc3dcafb81fa91e97c1e5825d0144a62b3e3a5b32ef295'
    
      33        '75b438724669793478e4bfed2745c4e9c97e25f24863eabe2c0f7bbb72571bc6f572bc07092576678162a7c7cf1f861e2046a69f11bb1408597e1e98bbd5e2b6')
    
      34
    
      35pkgver() {
    
      36	cd radicle-explorer
    
      37	git describe --long --tags | sed -r 's#^releases/##; s/^v//; s/-rc\./rc/; s/[^-]*-g/r&/; s/-/./g'
    
      38}
    
      39
    
      40prepare() {
    
      41	cd radicle-explorer
    
      42	pnpm import
    
      43	pnpm install \
    
      44		--dangerously-allow-all-builds \
    
      45		--shamefully-hoist \
    
      46		# EOL
    
      47
    
      48	cargo fetch --locked --target "$(rustc --print host-tuple)"
    
      49}
    
      50
    
      51build() {
    
      52	cd radicle-explorer
    
      53	export VITE_RUNTIME_CONFIG=true
    
      54	pnpm --config.verifyDepsBeforeRun=false \
    
      55		build
    
      56
    
      57	# _Disable_ cross-toolchain LTO because we are using different toolchains
    
      58	# for C/C++ and Rust code (i.e., LLVM LTO is incompatible with GCC LTO).
    
      59	# In this project, C/C++ code is linked into Rust code. Therefore, apply
    
      60	# a workaround to force generation of normal object code on C side:
    
      61	CFLAGS+=" -ffat-lto-objects"
    
      62	CXXFLAGS+=" -ffat-lto-objects"
    
      63
    
      64	export LIBGIT2_NO_VENDOR=1
    
      65	export RADICLE_VERSION="$pkgver"
    
      66	cargo build \
    
      67		--frozen \
    
      68		--release \
    
      69		--bins \
    
      70		# EOL
    
      71
    
      72	mkdir -p target/release/man
    
      73	for _man in crates/*/*.adoc; do
    
      74		asciidoctor --doctype manpage --backend manpage --destination-dir target/release/man "$_man"
    
      75	done
    
      76
    
      77	# XXX: tests rebuild and overwrite some of the binaries
    
      78	cp -a target/release -T target/dist
    
      79}
    
      80
    
      81check() {
    
      82	cd radicle-explorer
    
      83	(
    
      84	# Ideally, we'd use `env -i`, but `cargo test` forces a recompilation
    
      85	# if build flags don't match (+ we want to test what we ship anyway).
    
      86	# As a stop-gap, unset variables that are known to break tests
    
      87	# (and might have been set in makepkg.conf).
    
      88	unset "${!GIT_@}"
    
      89	cargo test \
    
      90		--frozen \
    
      91		# EOL
    
      92	)
    
      93}
    
      94
    
      95package_radicle-explorer-git() {
    
      96	pkgdesc+=" - explorer (frontend)"
    
      97	license=('GPL-3.0-only')
    
      98	depends=()
    
      99	optdepends=(
    
      100		'radicle-httpd: local backend for radicle-explorer'
    
      101	)
    
      102	provides=('radicle-explorer')
    
      103	conflicts=('radicle-explorer')
    
      104
    
      105	cd radicle-explorer
    
      106
    
      107	install -dm755 \
    
      108		"$pkgdir/usr/share/radicle-explorer"
    
      109	cp -dR --preserve=timestamps \
    
      110		build \
    
      111		-T "$pkgdir/usr/share/radicle-explorer"
    
      112	install -Dm644 \
    
      113		config/default.json \
    
      114		-T "$pkgdir/usr/share/radicle-explorer/config.json.example"
    
      115	# TODO: install into /etc?
    
      116	install -Dm644 \
    
      117		"$srcdir/radicle-explorer.config.json" \
    
      118		-T "$pkgdir/usr/share/radicle-explorer/config.json"
    
      119
    
      120	install -Dm644 \
    
      121		LICENSE \
    
      122		-t "$pkgdir/usr/share/licenses/$pkgname"
    
      123}
    
      124
    
      125package_radicle-httpd-git() {
    
      126	pkgdesc+=" - explorer (backend)"
    
      127	license=('Apache-2.0 OR MIT')
    
      128	depends=(
    
      129		'glibc'
    
      130		'libgcc'
    
      131		'libgit2' 'libgit2.so'
    
      132		'zlib'
    
      133		'radicle-node'
    
      134	)
    
      135	provides=('radicle-httpd')
    
      136	conflicts=('radicle-httpd')
    
      137
    
      138	cd radicle-explorer
    
      139
    
      140	install -Dm755 \
    
      141		target/dist/radicle-httpd \
    
      142		target/dist/radicle-search \
    
      143		-t "$pkgdir/usr/bin"
    
      144
    
      145	install -Dm644 \
    
      146		target/dist/man/radicle-httpd.1 \
    
      147		-t "$pkgdir/usr/share/man/man1"
    
      148
    
      149	install -Dm644 \
    
      150		"$srcdir/radicle-httpd.system.service" \
    
      151		"$pkgdir/usr/lib/systemd/system/radicle-httpd.service"
    
      152	install -Dm644 \
    
      153		"$srcdir/radicle-httpd.user.service" \
    
      154		"$pkgdir/usr/lib/systemd/user/radicle-httpd.service"
    
      155	install -Dm644 \
    
      156		"$srcdir/radicle-explorer.nginx.conf" \
    
      157		"$pkgdir/usr/share/doc/$pkgname/nginx/radicle-explorer.conf"
    
      158
    
      159	install -Dm644 \
    
      160		crates/*/LICENSE-* \
    
      161		-t "$pkgdir/usr/share/licenses/$pkgname"
    
      162}
    
      163

Changes since previous scan

--- PKGBUILD @ 2026-07-17 00:06
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,7 +2,7 @@
 
 pkgbase=radicle-explorer-git
 pkgname=(radicle-{explorer,httpd}-git)
-pkgver=0.25.0.r43.gdded3703e
+pkgver=0.26.0.r2.g3c2935704
 pkgrel=1
 pkgdesc="open source, peer-to-peer code collaboration stack built on Git"
 arch=('x86_64')
@@ -45,7 +45,6 @@
 		--shamefully-hoist \
 		# EOL
 
-	cd radicle-httpd
 	cargo fetch --locked --target "$(rustc --print host-tuple)"
 }
 
@@ -63,8 +62,6 @@
 	CXXFLAGS+=" -ffat-lto-objects"
 
 	export LIBGIT2_NO_VENDOR=1
-
-	cd radicle-httpd
 	export RADICLE_VERSION="$pkgver"
 	cargo build \
 		--frozen \
@@ -73,7 +70,7 @@
 		# EOL
 
 	mkdir -p target/release/man
-	for _man in *.adoc; do
+	for _man in crates/*/*.adoc; do
 		asciidoctor --doctype manpage --backend manpage --destination-dir target/release/man "$_man"
 	done
 
@@ -82,7 +79,7 @@
 }
 
 check() {
-	cd radicle-explorer/radicle-httpd
+	cd radicle-explorer
 	(
 	# Ideally, we'd use `env -i`, but `cargo test` forces a recompilation
 	# if build flags don't match (+ we want to test what we ship anyway).
@@ -138,10 +135,11 @@
 	provides=('radicle-httpd')
 	conflicts=('radicle-httpd')
 
-	cd radicle-explorer/radicle-httpd
+	cd radicle-explorer
 
 	install -Dm755 \
 		target/dist/radicle-httpd \
+		target/dist/radicle-search \
 		-t "$pkgdir/usr/bin"
 
 	install -Dm644 \
@@ -159,8 +157,7 @@
 		"$pkgdir/usr/share/doc/$pkgname/nginx/radicle-explorer.conf"
 
 	install -Dm644 \
-		LICENSE-APACHE \
-		LICENSE-MIT \
+		crates/*/LICENSE-* \
 		-t "$pkgdir/usr/share/licenses/$pkgname"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 15:55:03	MEDIUM	1
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2