sipp-bin

MEDIUM

maintainer arch-lsf 0 votes scanned 2026-08-31 03:44:41.618721

View on AUR

Why flagged

Installs a prebuilt binary from a third-party GitHub release with no source compilation, creating a supply-chain risk if the host or release is compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): Installs a prebuilt binary from a third-party GitHub release with no source compilation, creating a supply-chain risk if the host or release is compromised.

PKGBUILD

      1# Maintainer: local user
    
      2# 预编译二进制包: 不编译源码, 直接打包已编译好的 sipp (x86_64)
    
      3# 二进制来源: GitHub Release (https://github.com/Veng0923/sipp/releases)
    
      4# 注意: 本包装到 ~/.local/bin/sipp, 与官方 sipp 包不冲突
    
      5
    
      6pkgname=sipp-bin
    
      7pkgver=3.7.7
    
      8pkgrel=1
    
      9pkgdesc="A free open source test tool and traffic generator for the SIP protocol (prebuilt x86_64)"
    
      10arch=('x86_64')
    
      11url="http://github.com/sipp"
    
      12license=('GPL2')
    
      13depends=('gcc-libs' 'gsl' 'lksctp-tools' 'libpcap' 'ncurses' 'openssl')
    
      14source=("https://github.com/Veng0923/sipp/releases/download/${pkgver}-${pkgrel}/sipp")
    
      15sha256sums=('7ce318cd726969870d99dfa491c2f6b0f1507d93ef66707d64341ceb602beedd')
    
      16
    
      17package() {
    
      18  install -Dm755 "${srcdir}/sipp" "${pkgdir}${HOME}/.local/bin/sipp"
    
      19}
    
      20

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-31 03:44:41	Medium	2