topal
LOW
maintainer RAMChYLD
2 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The source is a git repository from a non-whitelisted host, but it is a legitimate project source used to build the software from scratch; no prebuilt binaries or executed payloads are involved, and the build process is transparent.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git repository from a non-whitelisted host, but it is a legitimate project source used to build the software from scratch; no prebuilt binaries or executed payloads are involved, and the build process is transparent.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:23
source=('git+https://dl.green-pike.co.uk/topal.git')
PKGBUILD
1 offending line(s) highlighted
1
# adopted from aur3 mirror
2
#
3
# Contributor: Adrian C. (anrxc) <anrxc..sysphere.org>
4
# Contributor: Jose Riha jose1711 gmail com
5
# Maintainer: Lee Chong Yew ramchyld -at- gmail -dot- com
6
7
pkgname=topal
8
pkgver=84
9
pkgrel=1
10
pkgdesc="Topal is a glue program that links GnuPG and Alpine"
11
arch=("i686" "x86_64")
12
url="https://zircon.org.uk/topal/"
13
license=("GPL3")
14
makedepends=("gcc-ada" "make" "lynx" "git")
15
optdepends=("alpine: for which topal was mainly written for"
16
"re-alpine: fork of alpine for which topal was mainly written for"
17
"gnupg: to encrypt, decrypt, sign and verify e-mail"
18
"metamail: to display and process MIME messages"
19
"mime-support: its run-mailcap tool as alternative to metamail"
20
"openssh: for remote and server mode of operation")
21
install="${pkgname}.install"
22
options=("!makeflags")
23
source=('git+https://dl.green-pike.co.uk/topal.git')
24
md5sums=('SKIP')
25
26
27
build() {
28
cd "${pkgname}"
29
30
# Remove PDF build stuff
31
sed -i 's/binary topal.pdf/binary/' Makefile
32
33
# Build Topal and MIME-tool
34
make distclean
35
make
36
}
37
38
package() {
39
cd "${pkgname}"
40
41
# Install Topal binary, manual page and documentation
42
install -D -m755 "${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
43
install -D -m644 "${pkgname}.man" "${pkgdir}/usr/share/man/man1/${pkgname}.1"
44
# Replaced by some PDF stuff which we will not build
45
#install -D -m644 README.txt "${pkgdir}/usr/share/doc/${pkgname}/README"
46
47
# Install Topal's version of MIME-tool and manual page
48
install -D -m755 MIME-tool/mime-tool "${pkgdir}/usr/bin/mime-tool"
49
install -D -m644 MIME-tool/mime-tool.man "${pkgdir}/usr/share/man/man1/mime-tool.1"
50
}
51
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |