topal
LOW
maintainer RAMChYLD
2 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The source is a git repository from a non-whitelisted host, but it is a legitimate project source used to build the software from scratch; no prebuilt binaries or executed payloads are involved, and the build process is transparent.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git repository from a non-whitelisted host, but it is a legitimate project source used to build the software from scratch; no prebuilt binaries or executed payloads are involved, and the build process is transparent.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:23
source=('git+https://dl.green-pike.co.uk/topal.git')
PKGBUILD
1 offending line(s) highlighted
1
# adopted from aur3 mirror
2
#
3
# Contributor: Adrian C. (anrxc) <anrxc..sysphere.org>
4
# Contributor: Jose Riha jose1711 gmail com
5
# Maintainer: Lee Chong Yew ramchyld -at- gmail -dot- com
6
7
pkgname=topal
8
pkgver=84
9
pkgrel=1
10
pkgdesc="Topal is a glue program that links GnuPG and Alpine"
11
arch=("i686" "x86_64")
12
url="https://zircon.org.uk/topal/"
13
license=("GPL3")
14
makedepends=("gcc-ada" "make" "lynx" "git")
15
optdepends=("alpine: for which topal was mainly written for"
16
"re-alpine: fork of alpine for which topal was mainly written for"
17
"gnupg: to encrypt, decrypt, sign and verify e-mail"
18
"metamail: to display and process MIME messages"
19
"mime-support: its run-mailcap tool as alternative to metamail"
20
"openssh: for remote and server mode of operation")
21
install="${pkgname}.install"
22
options=("!makeflags")
23
source=('git+https://dl.green-pike.co.uk/topal.git')
24
md5sums=('SKIP')
25
26
27
build() {
28
cd "${pkgname}"
29
30
# Remove PDF build stuff
31
sed -i 's/binary topal.pdf/binary/' Makefile
32
33
# Build Topal and MIME-tool
34
make distclean
35
make
36
}
37
38
package() {
39
cd "${pkgname}"
40
41
# Install Topal binary, manual page and documentation
42
install -D -m755 "${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
43
install -D -m644 "${pkgname}.man" "${pkgdir}/usr/share/man/man1/${pkgname}.1"
44
# Replaced by some PDF stuff which we will not build
45
#install -D -m644 README.txt "${pkgdir}/usr/share/doc/${pkgname}/README"
46
47
# Install Topal's version of MIME-tool and manual page
48
install -D -m755 MIME-tool/mime-tool "${pkgdir}/usr/bin/mime-tool"
49
install -D -m644 MIME-tool/mime-tool.man "${pkgdir}/usr/share/man/man1/mime-tool.1"
50
}
51
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |