sip3-captain-ce

LOW
maintainer lifespirit 2 votes base sip3 scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The package downloads a prebuilt .tgz from repo.sip3.io, a project-associated domain, for a frontend asset that is not executed at build time; the rest are source builds from GitHub; worst case of a swapped source is limited to static data injection, not code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .tgz from repo.sip3.io, a project-associated domain, for a frontend asset that is not executed at build time; the rest are source builds from GitHub; worst case of a swapped source is limited to static data injection, not code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:28 "sip3-hoof-ce.tgz::https://repo.sip3.io/jar/releases-ce/sip3-hoof/${pkgver}/sip3-hoof-latest.tgz"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Artem Popov <lifespirit@sip3.io>
2
3pkgbase=sip3
4pkgname=("${pkgbase}-captain-ce"
5 "${pkgbase}-salto-ce"
6 "${pkgbase}-twig-ce"
7 "${pkgbase}-hoof-ce")
8pkgver=2024.2.2
9pkgrel=2
10pkgdesc='SIP3 monitoring system'
11arch=('any')
12url='https://sip3.io'
13license=('Apache-2.0')
14makedepends=(
15 'git'
16 'curl'
17 'jdk-openjdk'
18 'maven'
19 'libpcap'
20)
21optdepends=(
22 'nginx: Lightweight HTTP server and IMAP/POP3 proxy server'
23 'mongodb: A high-performance, open source, schema-free document-oriented database'
24 'influxdb: Scalable datastore for metrics, events, and real-time analytics'
25)
26options=('!lto')
27source=(
28 "sip3-hoof-ce.tgz::https://repo.sip3.io/jar/releases-ce/sip3-hoof/${pkgver}/sip3-hoof-latest.tgz"
29 "sip3-twig-ce::git+https://github.com/sip3io/sip3-twig-ce.git#branch=release/$pkgver"
30 "sip3-salto-ce::git+https://github.com/sip3io/sip3-salto-ce.git#branch=release/$pkgver"
31 "sip3-captain-ce::git+https://github.com/sip3io/sip3-captain-ce.git#branch=release/$pkgver"
32 "logback-webhook-appender::git+https://github.com/sip3io/logback-webhook-appender.git#branch=release/1.0.6"
33 "sip3-parent::git+https://github.com/sip3io/sip3-parent.git#branch=release/$pkgver"
34 "sip3-commons::git+https://github.com/sip3io/sip3-commons.git#branch=release/$pkgver"
35 "sip3-captain.conf"
36 "captain-environment.conf"
37 "sip3-captain@.service"
38 "sip3-salto.conf"
39 "salto-environment.conf"
40 "sip3-salto.service"
41 "sip3-twig.conf"
42 "twig-environment.conf"
43 "sip3-twig.service"
44 "sysusers.conf"
45 "sip3-hoof.conf"
46 "settings.xml"
47)
48b2sums=(
49 'e4190beec73b1d0bc5e53325231d9aab2ed617382e50657a60db2f2e117676d9813d69aad85a71336af8374f5a03a430b116904d10a6f617d0145e97ce6e0b40'
50 'SKIP'
51 'SKIP'
52 'SKIP'
53 'SKIP'
54 'SKIP'
55 'SKIP'
56 'cceb9cd3b10e08b482931c130ec4893e489f33a99a0b310ea2cfed63284641e7323bbb97c5b498010eccf6ecbf6173aba73aebabca14393cb9b7789e126e4272'
57 '8f1916a34f5498d4cb1400ebe3ab2688d5606c0524f42caea300ab486d45d223ab7391ac0a527129b258281467c463c4a66ae9b1cea7b57d0594e2c8d6c75dbf'
58 '37ddd2ae8789e50c75e86edcf930de44f663350390c1ec548f8430567cde099c77d642cc42c266a6a5deae681c852e075d5aeb9d54e24dd4de38898a803acde9'
59 '441281e2c7a48c7bc4edd6cd2bbd4557d6b30833cc5de3937cd0f51344f60967d357cfcd74f92a1623d731c377ddd70c452cc6346bd23eba59540367f85d63df'
60 '11b99697f673c8c9e3ced5f8e44b0fd7ce4544f384e44157606d11cf3b2da19008f420e393220a18dd07fe1efa41847e1416317fdbecfb43bf0802bc5c702618'
61 '57fed3c49e5c97dcd879fb527d551bda8867bbeabac890f92f65d35c3ac591186932aba637216154e160690209cea4dcbb167373e223850379432c9c47277bf1'
62 '3fab6c3748adb07953dbb8f41bb210a57ee46820dfed28d50ffcd203f078f88c6d71200f6013491708470434d17542ef3fb8cf945b747ab829ea121ed1034857'
63 'a56f5e2d63bb3300b58d50108dd7fd68c80e25a9ae7c4bc4eeaa5340ecbcd19d6e4e6afc22d8e5f6f32eb992b747803f4ac903cbe98ce07a1af34253ea4f37d7'
64 '6af722085f8da2ba758542e20ba7ab61058bda0e417c1a6c0be86d282f060d5e7f79a093ea9f8f3cc81d66cec391f112dd0ce500387517da9f3b153c49906252'
65 '8275260f3123979a1e087e994732f9bf0c422ef2cdb8bd17e5a3e16100ae90f69582b5e687ab0666677cf1afda84e642b6e996f0d18def6533259bf153b29b55'
66 'ae5832060f90257f5e39e7e525fc66bd596652da0c6eaa93ceb3cae52bc5976e2c2ef645c85d31367e94cc4493cdc21189055d5adde9cd97ab22862938ffa518'
67 '40b0cc1035d1c283789631c6ebca3c9fef7df15c1f247e7a0141619888398d3367bebaeb3b9938d2f37e89e7af25d5d71ecb71aff805390aa93caec9479bfb8b'
68)
69
70build() {
71 cd "logback-webhook-appender"
72 mvn install -DskipTests
73
74 cd "../sip3-parent"
75 mvn install -DskipTests
76
77 cd "../sip3-commons"
78 mvn install -DskipTests
79
80 cd "../sip3-captain-ce"
81 mvn package -P executable-jar -DskipTests
82
83 cd "../sip3-salto-ce"
84 mvn package -P executable-jar -DskipTests -gs ${srcdir}/settings.xml
85
86 cd "../sip3-twig-ce"
87 mvn package -P executable-jar -DskipTests
88}
89
90package_sip3-captain-ce() {
91 pkgdesc+="(packets dumper)"
92 backup=(
93 'etc/sip3-captain/application.yml'
94 'etc/sip3-captain/logback.xml'
95 'etc/sip3-captain/vertx-options.json'
96 'etc/sip3-captain/environment.conf'
97 )
98 depends=(
99 'jdk-openjdk'
100 'libpcap'
101 )
102
103 cd "${srcdir}/sip3-captain-ce"
104
105 # binary
106 install -vDm755 -t "$pkgdir/opt/sip3-captain/sip3-captain.jar" target/sip3-captain-ce.jar
107 mkdir -p "${pkgdir}/etc/sip3-captain/"
108 mkdir -p "${pkgdir}/usr/lib/tmpfiles.d/"
109 mkdir -p "${pkgdir}/usr/lib/sysusers.d/"
110 mkdir -p "${pkgdir}/usr/lib/systemd/system/"
111 cp src/main/resources/application.yml "${pkgdir}/etc/sip3-captain/application-lo.yml"
112 cp src/main/resources/logback.xml "${pkgdir}/etc/sip3-captain/logback-lo.xml"
113 cp src/main/resources/vertx-options.json "${pkgdir}/etc/sip3-captain/"
114 cp ${srcdir}/captain-environment.conf "${pkgdir}/etc/sip3-captain/environment.conf"
115 cp ${srcdir}/sip3-captain.conf "${pkgdir}/usr/lib/tmpfiles.d/"
116 cp ${srcdir}/sip3-captain@.service "${pkgdir}/usr/lib/systemd/system/"
117 cp ${srcdir}/sysusers.conf "${pkgdir}/usr/lib/sysusers.d/sip3.conf"
118}
119
120package_sip3-salto-ce() {
121 pkgdesc+="(packets processor)"
122 backup=(
123 'etc/sip3-salto/application.yml'
124 'etc/sip3-salto/codecs.yml'
125 'etc/sip3-salto/logback.xml'
126 'etc/sip3-salto/vertx-options.json'
127 'etc/sip3-salto/environment.conf'
128 )
129 depends=(
130 'jdk-openjdk'
131 )
132
133 cd "${srcdir}/sip3-salto-ce"
134
135 # binary
136 install -vDm755 -t "$pkgdir/opt/sip3-salto/sip3-salto.jar" target/sip3-salto-ce.jar
137 mkdir -p "${pkgdir}/etc/sip3-salto/"
138 mkdir -p "${pkgdir}/usr/lib/tmpfiles.d/"
139 mkdir -p "${pkgdir}/usr/lib/sysusers.d/"
140 mkdir -p "${pkgdir}/usr/lib/systemd/system/"
141 cp src/main/resources/application.yml "${pkgdir}/etc/sip3-salto/"
142 cp src/main/resources/codecs.yml "${pkgdir}/etc/sip3-salto/"
143 cp src/main/resources/logback.xml "${pkgdir}/etc/sip3-salto/"
144 cp src/main/resources/vertx-options.json "${pkgdir}/etc/sip3-salto/"
145 cp -R src/main/resources/udf "${pkgdir}/opt/sip3-salto/"
146 cp ${srcdir}/salto-environment.conf "${pkgdir}/etc/sip3-salto/environment.conf"
147 cp ${srcdir}/sip3-salto.conf "${pkgdir}/usr/lib/tmpfiles.d/"
148 cp ${srcdir}/sip3-salto.service "${pkgdir}/usr/lib/systemd/system/"
149 cp ${srcdir}/sysusers.conf "${pkgdir}/usr/lib/sysusers.d/sip3.conf"
150}
151
152package_sip3-twig-ce() {
153 pkgdesc+="(API backend)"
154 backup=(
155 'etc/sip3-twig/application.yml'
156 'etc/sip3-twig/logback.xml'
157 'etc/sip3-twig/vertx-options.json'
158 'etc/sip3-twig/environment.conf'
159 )
160 depends=(
161 'jdk-openjdk'
162 )
163
164 cd "${srcdir}/sip3-twig-ce"
165
166 # binary
167 install -vDm755 -t "$pkgdir/opt/sip3-twig/sip3-twig.jar" target/sip3-twig-ce.jar
168 mkdir -p "${pkgdir}/etc/sip3-twig/"
169 mkdir -p "${pkgdir}/usr/lib/tmpfiles.d/"
170 mkdir -p "${pkgdir}/usr/lib/sysusers.d/"
171 mkdir -p "${pkgdir}/usr/lib/systemd/system/"
172 cp src/main/resources/application.yml "${pkgdir}/etc/sip3-twig/"
173 cp src/main/resources/logback.xml "${pkgdir}/etc/sip3-twig/"
174 cp ${srcdir}/twig-environment.conf "${pkgdir}/etc/sip3-twig/environment.conf"
175 cp ${srcdir}/sip3-twig.conf "${pkgdir}/usr/lib/tmpfiles.d/"
176 cp ${srcdir}/sip3-twig.service "${pkgdir}/usr/lib/systemd/system/"
177 cp ${srcdir}/sysusers.conf "${pkgdir}/usr/lib/sysusers.d/sip3.conf"
178}
179
180package_sip3-hoof-ce() {
181 pkgdesc+="(frontned)"
182 optdepends=(
183 'nginx'
184 )
185
186 cd "${srcdir}"
187
188 # binary
189 mkdir -p ${pkgdir}/srv/http/sip3-hoof
190 tar xvzf sip3-hoof-ce.tgz -C "${pkgdir}/srv/http/sip3-hoof/"
191 cp ${srcdir}/sip3-hoof.conf "${pkgdir}/srv/http/sip3-hoof-nginx.conf"
192}
193

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion