sober-bin

maintainer marmai · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt binary and its checksum manifest from the project's own release infrastructure; while the host is not whitelisted, the binary is verified against both a pinned hash in the PKGBUILD and a cross-checked line in the release manifest, providing strong integrity despite the non-standard domain.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary and its checksum manifest from the project's own release infrastructure; while the host is not whitelisted, the binary is verified against both a pinned hash in the PKGBUILD and a cross-checked line in the release manifest, providing strong integrity despite the non-standard domain.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 "https://git.sovereign-society.org/Sober/sober/releases/download/v${_upstream_version}/sober_v${_upstream_version}_linux_amd64"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Markus Maiwald <markus@maiwald.work>
    
      2pkgname=sober-bin
    
      3_upstream_version=0.8.2
    
      4pkgver="${_upstream_version//-/_}"
    
      5pkgrel=1
    
      6pkgdesc='Prevent AI-Slop: The Sober Raccoon is your local CodeRabbit: A Local-first repository governance assistant and code reviewer with deterministic review readiness'
    
      7arch=('x86_64')
    
      8# Marketing / product site (read about Sober). Source + releases: git.sovereign-society.org/Sober/sober
    
      9url='https://sober-dev.pages.dev'
    
      10license=('LSL-1.0')
    
      11depends=('tree-sitter')
    
      12provides=('sober')
    
      13conflicts=('sober')
    
      14
    
      15# Integrity model (why this is not "no verification"):
    
      16# 1) makepkg validates the binary against the pinned sha256sums[0] in this PKGBUILD
    
      17#    (the AUR git history is the trust anchor — standard Arch -bin practice).
    
      18# 2) prepare() re-checks the same binary against the release SHA256SUMS *line*
    
      19#    for this artifact only (cross-check vs the published release manifest).
    
      20# SHA256SUMS itself uses SKIP: that file is rewritten when OCI/Debian image
    
      21# assets are attached later; pinning its whole-file hash caused false AUR
    
      22# failures. The binary line inside it stays stable for a given release.
    
      23source=(
    
      24  "https://git.sovereign-society.org/Sober/sober/releases/download/v${_upstream_version}/sober_v${_upstream_version}_linux_amd64"
    
      25  "https://git.sovereign-society.org/Sober/sober/releases/download/v${_upstream_version}/SHA256SUMS"
    
      26)
    
      27sha256sums=(
    
      28  'b3dbf568bec51d7ffc25f2a941b1164379de97e5f3a1f7862d0a6ff5832803ca'
    
      29  'SKIP'
    
      30)
    
      31
    
      32prepare() {
    
      33  cd "${srcdir}"
    
      34  local bin="sober_v${_upstream_version}_linux_amd64"
    
      35  local line
    
      36
    
      37  if [[ ! -f SHA256SUMS ]]; then
    
      38    echo "error: release SHA256SUMS missing from sources" >&2
    
      39    return 1
    
      40  fi
    
      41  if [[ ! -f "${bin}" ]]; then
    
      42    echo "error: binary ${bin} missing from sources" >&2
    
      43    return 1
    
      44  fi
    
      45
    
      46  # Exact artifact line (hash + two spaces/tabs + filename).
    
      47  line="$(grep -E "^[0-9a-fA-F]{64}[[:space:]]+${bin}\$" SHA256SUMS || true)"
    
      48  if [[ -z "${line}" ]]; then
    
      49    echo "error: ${bin} is not listed in upstream SHA256SUMS" >&2
    
      50    echo "------- SHA256SUMS -------" >&2
    
      51    cat SHA256SUMS >&2 || true
    
      52    return 1
    
      53  fi
    
      54
    
      55  # Cross-check binary bytes against the release manifest line.
    
      56  if ! printf '%s\n' "${line}" | sha256sum -c -; then
    
      57    echo "error: binary failed verification against release SHA256SUMS" >&2
    
      58    return 1
    
      59  fi
    
      60
    
      61  # Defense in depth: manifest hash must equal the PKGBUILD pin (makepkg
    
      62  # already checked the file; this catches a stale pin vs updated release).
    
      63  local from_sums actual
    
      64  from_sums="$(printf '%s\n' "${line}" | awk '{print tolower($1)}')"
    
      65  actual="$(sha256sum "${bin}" | awk '{print tolower($1)}')"
    
      66  if [[ "${from_sums}" != "${actual}" ]]; then
    
      67    echo "error: SHA256SUMS hash (${from_sums}) != binary hash (${actual})" >&2
    
      68    return 1
    
      69  fi
    
      70  if [[ "${from_sums}" != "${sha256sums[0]}" ]]; then
    
      71    echo "error: PKGBUILD pin (${sha256sums[0]}) != release SHA256SUMS (${from_sums})" >&2
    
      72    echo "hint: maintainer must re-run scripts/publish-aur.sh after re-uploading the binary" >&2
    
      73    return 1
    
      74  fi
    
      75
    
      76  echo "ok: ${bin} matches PKGBUILD pin and release SHA256SUMS"
    
      77}
    
      78
    
      79package() {
    
      80  install -Dm755 "${srcdir}/sober_v${_upstream_version}_linux_amd64" \
    
      81    "${pkgdir}/usr/bin/sober"
    
      82  # Ship the release manifest so operators can re-verify offline.
    
      83  install -Dm644 "${srcdir}/SHA256SUMS" \
    
      84    "${pkgdir}/usr/share/doc/${pkgname}/SHA256SUMS"
    
      85}
    
      86

Changes since previous scan

--- PKGBUILD @ 2026-08-01 00:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 # Maintainer: Markus Maiwald <markus@maiwald.work>
 pkgname=sober-bin
-_upstream_version=0.8.1
+_upstream_version=0.8.2
 pkgver="${_upstream_version//-/_}"
 pkgrel=1
 pkgdesc='Prevent AI-Slop: The Sober Raccoon is your local CodeRabbit: A Local-first repository governance assistant and code reviewer with deterministic review readiness'
@@ -25,7 +25,7 @@
   "https://git.sovereign-society.org/Sober/sober/releases/download/v${_upstream_version}/SHA256SUMS"
 )
 sha256sums=(
-  'da95b1e6d0cec00c64dc7f5266470624319c1b5d17691c54d304266f8737fd3d'
+  'b3dbf568bec51d7ffc25f2a941b1164379de97e5f3a1f7862d0a6ff5832803ca'
   'SKIP'
 )
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 13:20:32	MEDIUM	1
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 21:16:48	MEDIUM	1
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 19:25:44	MEDIUM	1
2026-07-23 09:22:54	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 15:20:42	MEDIUM	2
2026-07-22 00:29:32	LOW	2
2026-07-21 11:16:59	MEDIUM	1
2026-07-21 00:24:15	LOW	2