schily-tools-star
maintainer aperez
· 1 votes
· base
schily-tools
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The source is a tarball from a plausible project mirror (dotsrc.org) hosting the official schilytools release; building from this source is normal AUR packaging and the worst case of a swapped tarball is limited to supply-chain risk of the build output, not active code execution or exfiltration.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from a plausible project mirror (dotsrc.org) hosting the official schilytools release; building from this source is normal AUR packaging and the worst case of a swapped tarball is limited to supply-chain risk of the build output, not active code execution or exfiltration.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:12
source=("https://mirrors.dotsrc.org/schilytools/schily-${_version}.tar.bz2")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Adrian Perez de Castro <aperez@igalia.com>
2
pkgbase=schily-tools
3
pkgname=(schily-tools-{sdd,star})
4
pkgdesc='Set of tools maintained by Jorg Schilling'
5
pkgver=2024.03.21
6
pkgrel=1
7
url=https://codeberg.org/schilytools/schilytools
8
arch=(x86_64)
9
license=(custom:CDDL)
10
depends=(libcap)
11
_version=${pkgver//./-}
12
source=("https://mirrors.dotsrc.org/schilytools/schily-${_version}.tar.bz2")
13
b2sums=('6e4487445e134092624b331d162bd9fd33ce88b19b8bad4eef7d0e16934fe08d131c70e9f07d6dfd651fea429f43bbff7ef8d73650535922a132ff02ff912bb6')
14
15
_tools=(
16
sdd
17
star
18
)
19
_deps=(
20
libdeflt
21
libfind
22
libschily
23
libmdigest
24
librmt
25
)
26
27
build () {
28
cd "schily-${_version}"
29
30
for i in "${_deps[@]}" "${_tools[@]}"; do
31
msg2 "Building $i..."
32
make -C "$i" GMAKE_NOWARN=true INS_BASE=/usr \
33
CFLAGS="${CFLAGS}" LDOPTX="${LDFLAGS}" CC="${CC}"
34
done
35
}
36
37
_installone () {
38
local subdir=$1
39
pkgdesc=$2
40
shift 2
41
depends+=("$@")
42
43
cd "schily-${_version}"
44
make -C "${subdir}" GMAKE_NOWARN=true INS_BASE=/usr DESTDIR="${pkgdir}" install
45
46
install -Dm644 CDDL.Schily.txt \
47
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
48
}
49
50
package_schily-tools-sdd () {
51
_installone sdd 'Replacement for "dd" included with schily-tools'
52
}
53
54
package_schily-tools-star () {
55
_installone star \
56
'Fast POSIX-compliant tape archiver included with schily-tools' \
57
acl bash
58
59
# Remove "tar" symlink to avoid conflicts with GNU tar.
60
rm -f "${pkgdir}/usr/bin/tar"
61
}
62
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |