sogo

maintainer deons · 13 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is downloaded from the project's official domain (sogo.nu), which hosts the upstream project's releases; building from official project sources is standard AUR practice and not inherently dangerous.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The source is downloaded from the project's official domain (sogo.nu), which hosts the upstream project's releases; building from official project sources is standard AUR practice and not inherently dangerous.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:41 source=("https://packages.sogo.nu/sources/SOGo-${pkgver}.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Deon Spengler <deon at spengler dot co dot za>
    
      2# Contributor: DJ Lucas <dj_AT_linuxfromscratch_DOT_ort>
    
      3# Contributor: Steven Hiscocks <steven [at] hiscocks [dot] me [dot] uk>
    
      4# Contributor:  Andre Wayand <aur-sogo@awayand.sleepmail.com>
    
      5pkgname=sogo
    
      6pkgdesc="groupware server built around OpenGroupware.org (OGo) and the SOPE application server"
    
      7pkgver=5.12.9
    
      8pkgrel=1
    
      9arch=('x86_64')
    
      10url="http://www.sogo.nu/"
    
      11license=('GPL-2.0-or-later')
    
      12options=('!strip')
    
      13replaces=('sogo2')
    
      14install=sogo.install
    
      15makedepends=('gcc-objc'
    
      16             'gnustep-make')
    
      17depends=("sope>=${pkgver}"
    
      18         'gnustep-base'
    
      19         'libmemcached'
    
      20         'memcached'
    
      21         'libwbxml>=0.11.7-2'
    
      22         'mariadb-libs'
    
      23         'postgresql-libs'
    
      24         'inetutils'
    
      25         'libsodium'
    
      26         'libytnef'
    
      27         'libzip'
    
      28         'oath-toolkit')
    
      29optdepends=('postgresql: run database server for sogo locally'
    
      30            'mariadb: run database server for sogo locally'
    
      31            'openldap: run directory server for sogo locally'
    
      32            'postfix: run smtp server for sogo locally'
    
      33            'dovecot: run imap server for sogo locally'
    
      34            'courier-imap: run imap server for sogo locally'
    
      35            'nginx: webserver to provide web interface locally'
    
      36            'apache: webserver to provide web interface locally'
    
      37            'lighttpd: webserver to provide web interface locally')
    
      38backup=('etc/sogo/sogo.conf'
    
      39        'etc/httpd/conf/extra/SOGo.conf'
    
      40        'etc/conf.d/sogo')
    
      41source=("https://packages.sogo.nu/sources/SOGo-${pkgver}.tar.gz"
    
      42        "sogo.service"
    
      43        "sogo.confd")
    
      44sha512sums=('cd9a27d99517dd94069425b8ce824b51dec22a7cf54c2e2b313a30ad21b988379717215bf4bc473dae3aac1879f599328a5f5d07eb5c7eadc4c768bb84c0288a'
    
      45            '73de6719ba3c17fb03dba4c7390f1e99ac4adff4c3413b6031ebb807fcef8a3f5eb0b8e3767a9560c2106b2f3470447b52803f5bd2f562b382e99c6382be2879'
    
      46            '51803a53f5ae32017281e3c891ae21c126a6adc10529669bd659cc4bffaeaae46a59db34c0c97bbc83e9e3be5e619e4ced170e18b31c1267d3c14ce20b54ccf4')
    
      47
    
      48build() {
    
      49  cd "SOGo-${pkgver}"
    
      50  ./configure --prefix=$(gnustep-config --variable=GNUSTEP_SYSTEM_ROOT) --disable-debug --enable-mfa
    
      51  make
    
      52}
    
      53
    
      54package() {
    
      55  cd "SOGo-${pkgver}"
    
      56  make install DESTDIR="${pkgdir}"
    
      57  install -D -m 0644 "${srcdir}"/sogo.service \
    
      58                     "${pkgdir}"/usr/lib/systemd/system/sogo.service
    
      59  install -D -m 0600 "${srcdir}"/SOGo-${pkgver}/Scripts/sogo.conf \
    
      60                     "${pkgdir}"/etc/sogo/sogo.conf
    
      61  install -D -m 0644 "${srcdir}"/SOGo-${pkgver}/Apache/SOGo.conf \
    
      62                     "${pkgdir}"/etc/httpd/conf/extra/SOGo.conf
    
      63  install -D -m 0644 "${srcdir}"/SOGo-${pkgver}/Scripts/logrotate \
    
      64                     "${pkgdir}"/etc/logrotate.d/sogo
    
      65  install -d -m 0755 "${pkgdir}"/usr/lib/sogo/scripts
    
      66  install    -m 0755 "${srcdir}"/SOGo-${pkgver}/Scripts/sql-*.sh \
    
      67                      "${pkgdir}"/usr/lib/sogo/scripts/
    
      68  install -D -m 0644 "${srcdir}"/sogo.confd \
    
      69                     "${pkgdir}"/etc/conf.d/sogo
    
      70  cd "${srcdir}/SOGo-${pkgver}/ActiveSync"
    
      71  make PYTHON=/usr/bin/python2 install DESTDIR="${pkgdir}" GNU_SYSTEM_ADMIN_TOOLS="/usr/bin"
    
      72}
    
      73

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2