sphinx-beta

maintainer grevus · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a beta tarball from the official project domain sphinxsearch.com, building the project's own source is normal AUR packaging, and the host, while not whitelisted, is plausibly official.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a beta tarball from the official project domain sphinxsearch.com, building the project's own source is normal AUR packaging, and the host, while not whitelisted, is plausibly official.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 "http://sphinxsearch.com/files/${_pkgname}-${pkgver}-beta.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Lobtsov Alexander <alex at lobtsov dot com>
    
      2pkgname=sphinx-beta
    
      3_pkgname=sphinx
    
      4pkgver=2.3.2
    
      5pkgrel=1
    
      6pkgdesc="Free open-source SQL full-text search engine (SVN version, with libsphinxclient, with systemd support)"
    
      7arch=(i686 x86_64)
    
      8url="http://www.sphinxsearch.com"
    
      9license=('GPL')
    
      10depends=('libmariadbclient')
    
      11source=(
    
      12    "http://sphinxsearch.com/files/${_pkgname}-${pkgver}-beta.tar.gz"
    
      13    "sphinx.service"
    
      14)
    
      15
    
      16provides=("sphinx")
    
      17conflicts=("sphinx" "sphinx-svn")
    
      18
    
      19# https://bbs.archlinux.org/viewtopic.php?id=77214
    
      20options=('!makeflags')
    
      21
    
      22sha256sums=('d2e71e094b7f979cdd554069006983e1c1289601d8572428b36d488c61621460'
    
      23            '847218ba5cd0b8f5a3b0d851352ffca1085229bfdf2779cbe2eff5e5eef99351')
    
      24
    
      25package() {
    
      26  cd "${srcdir}/${_pkgname}-${pkgver}-beta"
    
      27
    
      28  msg "Starting sphinx make..."
    
      29
    
      30  ./configure --prefix=/usr \
    
      31  --exec-prefix=/usr \
    
      32  --program-prefix=sphinx- \
    
      33  --localstatedir=/var/lib/sphinx \
    
      34  --sysconfdir=/etc/sphinx \
    
      35  --enable-id64
    
      36  make || return 1
    
      37  make DESTDIR=${pkgdir} -j4 install || return 1
    
      38
    
      39  cd "$srcdir/${_pkgname}-${pkgver}-beta/api/libsphinxclient"
    
      40  msg "Starting libsphinxclient make..."
    
      41
    
      42  sed -i 's/\/lib\/cpp/\/usr\/bin\/cpp/g' ./configure
    
      43
    
      44  ./configure --prefix=/usr \
    
      45  --exec-prefix=/usr \
    
      46  --program-prefix=sphinx- \
    
      47  --localstatedir=/var/lib/sphinx \
    
      48  --sysconfdir=/etc/sphinx \
    
      49  --enable-id64
    
      50  make || return 1
    
      51  make DESTDIR=${pkgdir} install || return 1
    
      52
    
      53  msg "Install service file..."
    
      54
    
      55  install -Dm644 "${srcdir}/sphinx.service" "${pkgdir}/usr/lib/systemd/system/sphinx.service"
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2