usc

MEDIUM

maintainer juanvel400 1 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

Source tarball is downloaded from a personal domain (dl.juanvel400.com) unrelated to any major forge or official infrastructure, making it silently swappable; it is a compiled binary artifact built from an unverifiable source, though a checksum is provided and the build process is otherwise straightforward.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("https://dl.juanvel400.com/usc/usc-$pkgver.tar.xz")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 60%): Source tarball is downloaded from a personal domain (dl.juanvel400.com) unrelated to any major forge or official infrastructure, making it silently swappable; it is a compiled binary artifact built from an unverifiable source, though a checksum is provided and the build process is otherwise straightforward.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: juanvel400 <me@juanvel400.com>
    
      2pkgname=usc
    
      3pkgver=0.2.0
    
      4pkgrel=1
    
      5epoch=
    
      6pkgdesc="a tiny link shortener"
    
      7arch=(x86_64)
    
      8url="https://sr.ht/~juanvel400/usc"
    
      9license=('BSD-3-Clause')
    
      10groups=()
    
      11depends=(gdbm)
    
      12makedepends=(meson ninja)
    
      13checkdepends=()
    
      14optdepends=()
    
      15provides=()
    
      16conflicts=()
    
      17replaces=()
    
      18backup=()
    
      19options=()
    
      20install=
    
      21changelog=
    
      22source=("https://dl.juanvel400.com/usc/usc-$pkgver.tar.xz")
    
      23noextract=()
    
      24sha256sums=('68f0fb0138c5c36bdcb0fcd21279ec60263585ed0d5159235eb9a051dc1e621a')
    
      25validpgpkeys=()
    
      26
    
      27build() {
    
      28    cd "$pkgname-$pkgver"
    
      29    meson setup build \
    
      30        --prefix=/usr \
    
      31        --buildtype=release \
    
      32        --localstatedir=/var
    
      33    meson compile -C build
    
      34}
    
      35
    
      36check() {
    
      37    cd "$pkgname-$pkgver"
    
      38    meson test -C build
    
      39}
    
      40
    
      41package() {
    
      42    cd "$pkgname-$pkgver"
    
      43    meson install -C build --destdir="$pkgdir/"
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	3
2026-10-16 00:12:47	Medium	3
2026-10-15 00:28:05	Medium	3
2026-10-14 00:06:47	Medium	3
2026-10-13 21:21:58	Medium	3
2026-10-13 21:18:20	Medium	2