reed-alert-git

LOW

maintainer ganymede 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is a git repository from a personal domain, which is not on a standard forge but plausibly the project's own; building from source is normal for AUR and the package installs only compiled artifacts and documentation, with no evidence of malicious payloads or remote code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The source is a git repository from a personal domain, which is not on a standard forge but plausibly the project's own; building from source is normal for AUR and the package installs only compiled artifacts and documentation, with no evidence of malicious payloads or remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=('git://bitreich.org/reed-alert')

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ganymede < ganymede _AT_ analogon _DOT_ eu>
    
      2
    
      3pkgname=reed-alert-git
    
      4_pkgname=reed-alert
    
      5pkgver=r88.b9d5e56
    
      6pkgver() {
    
      7  cd "$_pkgname"
    
      8  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      9}
    
      10pkgrel=1
    
      11pkgdesc="reed-alert is a small and simple monitoring tool for your server, written in Common Lisp"
    
      12arch=('any')
    
      13optdepends=('ecl' 'sbcl')
    
      14url="https://dataswamp.org/~solene/2018-01-17-reed-alert.html"
    
      15license=('custom')
    
      16source=('git://bitreich.org/reed-alert')
    
      17md5sums=('SKIP')
    
      18install=reed-alert-git.install
    
      19
    
      20build() {
    
      21  cd "$_pkgname"
    
      22  sed -i -e 's:/usr/local:/usr:' Makefile
    
      23  sed -i -e 's/-o root -g bin//' Makefile
    
      24  sed -i -e 's/-o root -g wheel//' Makefile
    
      25  make
    
      26}
    
      27
    
      28package() {
    
      29  cd "$_pkgname"
    
      30  make DESTDIR="$pkgdir" install
    
      31  install -Dm644 LICENSE "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
    
      32  install -Dm644 README "$pkgdir"/usr/share/doc/$pkgname/README
    
      33  install -Dm644 example-full.lisp "$pkgdir"/usr/share/doc/$pkgname/example-full.lisp
    
      34  install -Dm644 example-simple.lisp "$pkgdir"/usr/share/doc/$pkgname/example-simple.lisp
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2