rsrpc-git

LOW

maintainer k1f0 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The non-standard host (discord.com) provides a JSON data file used by the application, not executable code; the worst case of tampering is service disruption, not remote code execution, and the primary source is the project's own Git repository built from scratch.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host (discord.com) provides a JSON data file used by the application, not executable code; the worst case of tampering is service disruption, not remote code execution, and the primary source is the project's own Git repository built from scratch.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "https://discord.com/api/v10/applications/detectable"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: k1f0 <archlinux at k1f0.mozmail.com>
    
      2
    
      3pkgname=rsrpc-git
    
      4pkgver=r243.4ff3d5e
    
      5pkgrel=1
    
      6pkgdesc="Rust implementation of Discord RPC server"
    
      7arch=("x86_64" "aarch64")
    
      8url="https://github.com/SpikeHD/rsRPC"
    
      9license=("MIT")
    
      10makedepends=("cargo" "git")
    
      11provides=("${pkgname%-git}")
    
      12conflics=("${pkgname%-git}")
    
      13install="rsrpc.install"
    
      14source=("${pkgname%-git}::git+${url}.git"
    
      15        "https://discord.com/api/v10/applications/detectable"
    
      16        "rsrpc.install"
    
      17        "rsrpc.service")
    
      18sha256sums=('SKIP'
    
      19            'SKIP'
    
      20            'c96484996efde8defc8eb35b84766875732d0a105ef3b7c9bbabe9645f594ac3'
    
      21            '6e39467d6d5a5fd93e4e8c8607296771958b70f5744aeb5940adf04ecaf58df4')
    
      22options=(!debug)
    
      23
    
      24pkgver() {
    
      25  cd "${srcdir}/${pkgname%-git}"
    
      26  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      27}
    
      28
    
      29prepare() {
    
      30  cd "${srcdir}/${pkgname%-git}"
    
      31  cargo fetch --locked --target "${CARCH}-unknown-linux-gnu"
    
      32}
    
      33
    
      34build() {
    
      35  cd "${srcdir}/${pkgname%-git}"
    
      36  export RUSTUP_TOOLCHAIN=stable
    
      37  export CARGO_TARGET_DIR=target
    
      38  cargo build --frozen --release --package rsrpc-cli
    
      39}
    
      40
    
      41package() {
    
      42  # install binary
    
      43  cd "${srcdir}/${pkgname%-git}"
    
      44  install -Dm0755 "target/release/${pkgname%-git}-cli" "${pkgdir}/usr/bin/${pkgname%-git}-cli"
    
      45  # license
    
      46  install -Dm0644 "LICENSE" "${pkgdir}/usr/share/licenses/${pkgname%-git}"
    
      47  # install detectable database
    
      48  cd "${srcdir}"
    
      49  mkdir -p "${pkgdir}/opt/rsrpc"
    
      50  install -Dm0644 "detectable" "${pkgdir}/opt/rsrpc/detectable.json"
    
      51  # install system service
    
      52  install -Dm0644 "rsrpc.service" "${pkgdir}/usr/lib/systemd/user/rsrpc.service"
    
      53}
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2