repman

MEDIUM

maintainer mipi 1 votes scanned 2026-09-16 13:22:46.391962

View on AUR

Why flagged

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("https://${_pkgorg}/${pkgname}/archive/${pkgver}.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# SPDX-FileCopyrightText: 2023-2026 Michael Picht <mipi@fsfe.org>
    
      2#
    
      3# SPDX-License-Identifier: GPL-3.0-or-later
    
      4
    
      5# Maintainer: Michael Picht <mipi@fsfe.org>
    
      6
    
      7_pkgorg=codeberg.org/mipi
    
      8pkgname=repman
    
      9pkgver=v0.7.14
    
      10pkgrel=1
    
      11pkgdesc="Manage (remote) custom repositories for Arch Linux packages"
    
      12arch=(
    
      13  aarch64
    
      14  x86_64
    
      15)
    
      16url="https://${_pkgorg}/${pkgname}/"
    
      17license=(GPL-3.0-or-later)
    
      18source=("https://${_pkgorg}/${pkgname}/archive/${pkgver}.tar.gz")
    
      19sha256sums=('8f544bbd69f7aa61785ce0c30ffeb78353259ae4b6044610b9277f7144d24e1c')
    
      20conflicts=(repman-git)
    
      21backup=("etc/repman.conf")
    
      22depends=(
    
      23  binutils
    
      24  "pacman>=6.0.0"
    
      25)
    
      26depends_x86_64=(devtools)
    
      27depends_aarch64=(devtools-alarm)
    
      28optdepends=(
    
      29  "distcc: for distributed builds"
    
      30  "git: to manage packages from AUR"
    
      31  "gnupg: in case packages and/or repository DB's should be signed"
    
      32  "rsync: support of SSH-accessible remote storage locations"
    
      33  "openssh: support of SSH-accessible remote storage locations"
    
      34  "s3cmd: support of AWS S3"
    
      35  "google-cloud-cli: support of Google Cloud Platform"
    
      36)
    
      37makedepends=(
    
      38  asciidoctor
    
      39  bash
    
      40  cargo
    
      41  clang
    
      42  git
    
      43  make
    
      44)
    
      45options=(
    
      46  !debug
    
      47)
    
      48
    
      49build() {
    
      50  cd "${pkgname}" || return
    
      51  make
    
      52}
    
      53
    
      54package() {
    
      55  cd "${pkgname}" || return
    
      56  make DESTDIR="$pkgdir" install
    
      57}
    
      58

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-09-16 13:22
@@ -1,3 +1,7 @@
+# SPDX-FileCopyrightText: 2023-2026 Michael Picht <mipi@fsfe.org>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
 # Maintainer: Michael Picht <mipi@fsfe.org>
 
 _pkgorg=codeberg.org/mipi
@@ -9,10 +13,10 @@
   aarch64
   x86_64
 )
-license=(GPL3)
+url="https://${_pkgorg}/${pkgname}/"
+license=(GPL-3.0-or-later)
 source=("https://${_pkgorg}/${pkgname}/archive/${pkgver}.tar.gz")
-sha256sums=('fbc3a3beda180c4665a247be8d7d786ff0db27cbac792d34c8bf632dd8922c8f')
-validpgpkeys=(11ECD6695134183B3E7AF1C2223AAA374A1D59CE) # Michael Picht <mipi@fsfe.org>
+sha256sums=('8f544bbd69f7aa61785ce0c30ffeb78353259ae4b6044610b9277f7144d24e1c')
 conflicts=(repman-git)
 backup=("etc/repman.conf")
 depends=(

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-16 13:22:46	Medium	1
2026-06-19 19:07:35	Clean	2
2026-06-18 16:11:54	Medium	1