ustr (CLEAN) - AURWatch

Triggered rules

Clean AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it CLEAN (confidence 95%): Source tarball is downloaded from the project's own official domain (www.and.org/ustr/) with an md5 checksum; this is a normal AUR build of a C library from its upstream source.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=(http://www.and.org/ustr/$pkgver/ustr-$pkgver.tar.bz2)

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

1 offending line(s) highlighted

      1# $Id: PKGBUILD 266875 2017-11-15 14:29:11Z foutrelis $
    
      2# Maintainer: Sergej Pupykin <pupykin.s+arch@gmail.com>
    
      3
    
      4pkgname=ustr
    
      5pkgver=1.0.4
    
      6pkgrel=4
    
      7pkgdesc="micro string API for C"
    
      8arch=(x86_64)
    
      9url="http://www.and.org/ustr/"
    
      10license=('GPL')
    
      11depends=('glibc')
    
      12source=(http://www.and.org/ustr/$pkgver/ustr-$pkgver.tar.bz2)
    
      13md5sums=('93147d9f0c9765d4cd0f04f7e44bdfce')
    
      14
    
      15build() {
    
      16  cd "$srcdir/$pkgname-$pkgver"
    
      17  make
    
      18}
    
      19
    
      20package() {
    
      21  cd "$srcdir/$pkgname-$pkgver"
    
      22  make DESTDIR="$pkgdir" install
    
      23  mv "$pkgdir"/usr/share/doc/man "$pkgdir"/usr/share/
    
      24}
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-19 00:03:55	Clean	3
2026-10-18 23:23:07	Medium	2
2026-09-26 17:17:14	Clean	3
2026-09-26 17:15:25	Medium	2