rclone-beta-bin
maintainer lapsus
· 1 votes
· scanned 2026-08-18 00:03:42.021799
LOW
View on AUR ↗
Why flagged
The package downloads prebuilt rclone binaries from the official beta.rclone.org domain, which is the project's own release infrastructure; despite the static analyzer flagging the host as non-standard, the source is legitimate and checksums are verified, making this a normal AUR binary package with low risk.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt rclone binaries from the official beta.rclone.org domain, which is the project's own release infrastructure; despite the static analyzer flagging the host as non-standard, the source is legitimate and checksums are verified, making this a normal AUR binary package with low risk.
2 higher static findings superseded - not the current verdict (shown for transparency)
MEDIUM
External download from an untrusted host, not in source=()
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:37
size=$(curl -fsSI --http1.1 "https://beta.rclone.org/rclone-beta-latest-linux-amd64.zip" |
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:23
source_i686=("rclone-v${_upver}-linux-386.zip::https://beta.rclone.org/v${_upver}/rclone-v${_upver}-linux-386.zip")
PKGBUILD
2 offending line(s) highlighted
1
#!/bin/bash
2
3
# Maintainer: PumpkinCheshire <me at pumpkincheshire dot com>
4
5
pkgname=rclone-beta-bin
6
_srcname=rclone
7
pkgrel=1
8
pkgver=1.76.0_beta.10148.a1f98b49d
9
_upver=${pkgver//_/-}
10
pkgdesc="Sync files to and from Google Drive, S3, Swift, Cloudfiles, Dropbox and Google Cloud Storage. (Beta version)"
11
provides=('rclone')
12
conflicts=('rclone' 'rclone-git' 'rclone-bin')
13
url="https://beta.rclone.org/"
14
license=('MIT')
15
options=('!debug')
16
depends=('glibc')
17
arch=('i686' 'x86_64' 'armv6h' 'armv7h' 'aarch64')
18
_arch='linux-386'
19
[ "$CARCH" = 'x86_64' ] && _arch='linux-amd64'
20
[ "$CARCH" = 'armv6h' ] && _arch='linux-arm'
21
[ "$CARCH" = 'armv7h' ] && _arch='linux-arm-v7'
22
[ "$CARCH" = 'aarch64' ] && _arch='linux-arm64'
23
source_i686=("rclone-v${_upver}-linux-386.zip::https://beta.rclone.org/v${_upver}/rclone-v${_upver}-linux-386.zip")
24
source_x86_64=("rclone-v${_upver}-linux-amd64.zip::https://beta.rclone.org/v${_upver}/rclone-v${_upver}-linux-amd64.zip")
25
source_armv6h=("rclone-v${_upver}-linux-arm.zip::https://beta.rclone.org/v${_upver}/rclone-v${_upver}-linux-arm.zip")
26
source_armv7h=("rclone-v${_upver}-linux-arm-v7.zip::https://beta.rclone.org/v${_upver}/rclone-v${_upver}-linux-arm-v7.zip")
27
source_aarch64=("rclone-v${_upver}-linux-arm64.zip::https://beta.rclone.org/v${_upver}/rclone-v${_upver}-linux-arm64.zip")
28
29
b2sums_i686=('6d988f019996d62bce3bf1636d94b637b813fd98699c09301c0f79316d62b3d3a18eecbc45b3c666d8e9c521c361fa82d808d855de67df4d3a747971f6848b34')
30
b2sums_x86_64=('0279740ced484ee85bdb102d2c214f2b115df8b1fd26ec8b6537ce0612a0ed8d9e0ab7cb5ec132aa3ebc60d383532d1d231cb2a397e8af72aad1ea1669005b83')
31
b2sums_armv6h=('9aadbe5301dd0fc30570b016fae991e1d9f472ea261e846bec406368dc2de4242e42a32bc082c437b934a3b1519b0f5b236034ec2aa2d8f871f152170ea26b2a')
32
b2sums_armv7h=('c29bf8f57ac743ac22e7671878be14267934e866510bad580164016e2a94728f96ce2d67b016c7bf6bf5f94b6d14d64499110e24d32f625fa22ccae36bc449e0')
33
b2sums_aarch64=('fe158e60e11417b82ce527c9276e329a6ebd80c3251778ae6532cf16f7c7c523303587f41b8a1e90fbbb11efc19c26c7ed0a51d0636f51e9e499a5ed40e15c53')
34
35
latestver() {
36
local size ver
37
size=$(curl -fsSI --http1.1 "https://beta.rclone.org/rclone-beta-latest-linux-amd64.zip" |
38
sed -nE 's/^content-length: *([0-9]+).*/\1/Ip') || return 1
39
[[ -n $size ]] || return 1
40
ver=$(curl -fsS --http1.1 -r "$((size - 4096))-$((size - 1))" \
41
"https://beta.rclone.org/rclone-beta-latest-linux-amd64.zip" |
42
strings | grep -oP 'rclone-v\K[0-9]+\.[0-9]+\.[0-9]+-beta\.[0-9]+\.[0-9a-f]+' |
43
head -1) || return 1
44
[[ -n $ver ]] || return 1
45
printf '%s\n' "$ver" | tr '-' '_'
46
}
47
48
49
package() {
50
cd "$srcdir/${_srcname}-v${_upver}-${_arch}" || exit
51
52
install -Dm755 rclone "$pkgdir/usr/bin/rclone"
53
54
# install -Dm644 $srcdir/COPYING "$pkgdir/usr/share/licenses/$pkgname/COPYING"
55
install -Dm644 rclone.1 "$pkgdir/usr/share/man/man1/rclone.1"
56
install -d "$pkgdir/usr/share/doc/$pkgname"
57
install -t "$pkgdir/usr/share/doc/$pkgname" -m644 README.html README.txt
58
}
59
Changes since previous scan
--- PKGBUILD @ 2026-08-17 00:18+++ PKGBUILD @ 2026-08-18 00:03@@ -5,7 +5,7 @@ pkgname=rclone-beta-bin _srcname=rclone pkgrel=1-pkgver=1.76.0_beta.10147.f0b210a88+pkgver=1.76.0_beta.10148.a1f98b49d _upver=${pkgver//_/-} pkgdesc="Sync files to and from Google Drive, S3, Swift, Cloudfiles, Dropbox and Google Cloud Storage. (Beta version)" provides=('rclone')@@ -26,11 +26,11 @@ source_armv7h=("rclone-v${_upver}-linux-arm-v7.zip::https://beta.rclone.org/v${_upver}/rclone-v${_upver}-linux-arm-v7.zip") source_aarch64=("rclone-v${_upver}-linux-arm64.zip::https://beta.rclone.org/v${_upver}/rclone-v${_upver}-linux-arm64.zip") -b2sums_i686=('d28dc7fcb54cfff62b3ec9aaded709cb8ce8d46de72f53c0c264b819cdd08eee29ca1a13990ceb7b25243a95625838377cf5a749761c224fa453a4859014600e')-b2sums_x86_64=('469f6f08d296d4a9006f8cce3836eb84c44a48e5ff3fe83dba82675193afd977eb3a1386ca5554cd321becdb955429946370481a508996b51010bc79c9642120')-b2sums_armv6h=('89e9192c87ae7cde0ff0b4f2f94e0092997e8d36ce2d01470313f7b42bbcf81104a34b7656182e6ed76666ab4fa6958bda63470396fea455242c27ab0e94101e')-b2sums_armv7h=('ec47155ac56ee82d83b025f26a12525b865981f6ddf8670b1d8f39df53470317a79eaf8039307f2f10018edac373addf9596d38439fc1db376fcfba212417731')-b2sums_aarch64=('420e65d0bcbdc0cccd2750ae91375027f72b649a9f307163424f6e3af142e97866a34b48ffd4994ec3c02a69106e126b925c8388c145e10e2c63c99e93166a20')+b2sums_i686=('6d988f019996d62bce3bf1636d94b637b813fd98699c09301c0f79316d62b3d3a18eecbc45b3c666d8e9c521c361fa82d808d855de67df4d3a747971f6848b34')+b2sums_x86_64=('0279740ced484ee85bdb102d2c214f2b115df8b1fd26ec8b6537ce0612a0ed8d9e0ab7cb5ec132aa3ebc60d383532d1d231cb2a397e8af72aad1ea1669005b83')+b2sums_armv6h=('9aadbe5301dd0fc30570b016fae991e1d9f472ea261e846bec406368dc2de4242e42a32bc082c437b934a3b1519b0f5b236034ec2aa2d8f871f152170ea26b2a')+b2sums_armv7h=('c29bf8f57ac743ac22e7671878be14267934e866510bad580164016e2a94728f96ce2d67b016c7bf6bf5f94b6d14d64499110e24d32f625fa22ccae36bc449e0')+b2sums_aarch64=('fe158e60e11417b82ce527c9276e329a6ebd80c3251778ae6532cf16f7c7c523303587f41b8a1e90fbbb11efc19c26c7ed0a51d0636f51e9e499a5ed40e15c53') latestver() { local size verScan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-18 00:03:42 | LOW | 3 |
| 2026-08-17 09:35:23 | MEDIUM | 2 |
| 2026-08-17 00:18:29 | LOW | 3 |
| 2026-08-16 00:03:42 | LOW | 3 |
| 2026-08-15 19:31:13 | MEDIUM | 2 |
| 2026-08-15 00:26:13 | LOW | 3 |
| 2026-08-14 11:29:14 | MEDIUM | 2 |
| 2026-08-14 00:03:41 | LOW | 3 |
| 2026-08-13 21:26:43 | MEDIUM | 2 |
| 2026-08-13 00:17:07 | LOW | 3 |
| 2026-08-12 15:24:23 | MEDIUM | 2 |
| 2026-08-12 00:27:08 | LOW | 3 |
| 2026-08-11 23:21:47 | MEDIUM | 2 |
| 2026-08-11 19:21:46 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | CLEAN | 3 |
| 2026-07-30 23:17:02 | MEDIUM | 2 |
| 2026-07-30 17:15:21 | MEDIUM | 2 |
| 2026-07-30 11:14:12 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | LOW | 3 |
| 2026-07-29 23:13:22 | MEDIUM | 2 |