uup-converter-git

maintainer dreieck · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a git repository on a non-whitelisted but plausibly project-owned host (git.uupdump.net), which is used by the project; this is normal AUR packaging behavior and not inherently dangerous.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a git repository on a non-whitelisted but plausibly project-owned host (git.uupdump.net), which is used by the project; this is normal AUR packaging behavior and not inherently dangerous.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:41 "${_pkgname}::git+https://${_githost}/${_gituser}/${_gitname}.git"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  dreieck (https://aur.archlinux.org/account/dreieck)
    
      2
    
      3_gitname="converter"
    
      4_pkgname="uup-converter"
    
      5pkgname="${_pkgname}-git"
    
      6pkgver=0.7.3.r63.20251026.dbc65de
    
      7pkgrel=1
    
      8pkgdesc="A basic UUP converter aimed at Linux and macOS users who don't have access to any Windows machine, but want or need to create an ISO image for latest Windows Insider version downloaded from UUP dump (uupdump.net)."
    
      9groups=('uup-dump')
    
      10arch=(
    
      11  'any'
    
      12)
    
      13_githost='git.uupdump.net'
    
      14_gituser='uup-dump'
    
      15url="https://${_githost}/${_gituser}/${_gitname}"
    
      16license=("MIT")
    
      17depends=(
    
      18  'bash'
    
      19
    
      20  'aria2'
    
      21  'cabextract'
    
      22  'chntpw'
    
      23  'findutils' # For 'find'
    
      24  'grep'
    
      25  'wimlib'    # For 'wimlib-imagex'
    
      26
    
      27  'cdrtools' # 'genisoimage' or 'mkisofs' is needed by the script.
    
      28)
    
      29makedepends=(
    
      30  'git'
    
      31)
    
      32optdepends=()
    
      33provides=(
    
      34  "${_pkgname}=${pkgver}"
    
      35)
    
      36conflicts=(
    
      37  "${_pkgname}"
    
      38)
    
      39
    
      40source=(
    
      41  "${_pkgname}::git+https://${_githost}/${_gituser}/${_gitname}.git"
    
      42  "uup-converter.sh"
    
      43)
    
      44sha256sums=(
    
      45  'SKIP'
    
      46  '50f3218e9b89d6956ed3bac141fd80f6c93e54367ee94bb06392eb760358cac3'
    
      47)
    
      48
    
      49prepare() {
    
      50  cd "${srcdir}/${_pkgname}"
    
      51
    
      52  git log > "${srcdir}/git.log"
    
      53}
    
      54
    
      55pkgver() {
    
      56  cd "${srcdir}/${_pkgname}"
    
      57
    
      58  _ver="$(grep -E '^[[:space:]]*scriptName=' convert.sh | awk -F= '{print $2}' | tr -d \"\' | awk -F# '{print $1}' | sed -E 's|UUP Converter v||')"
    
      59  #_ver="$(git describe --tags | sed -E -e 's|^[vV]||' -e 's|\-g[0-9a-f]*$||' | tr '-' '+')"
    
      60  _rev="$(git rev-list --count HEAD)"
    
      61  _date="$(git log -1 --date=format:"%Y%m%d" --format="%ad")"
    
      62  _hash="$(git rev-parse --short HEAD)"
    
      63
    
      64  if [ -z "${_ver}" ]; then
    
      65    error "Version could not be determined."
    
      66    return 1
    
      67  else
    
      68    printf '%s' "${_ver}.r${_rev}.${_date}.${_hash}"
    
      69  fi
    
      70}
    
      71
    
      72
    
      73package() {
    
      74  cd "${srcdir}/${_pkgname}"
    
      75  printf '%s\n' " --> installing ..."
    
      76
    
      77  install -Dvm755 -t "${pkgdir}/usr/lib/uup-converter"  convert.sh
    
      78  install -Dvm644 -t "${pkgdir}/usr/lib/uup-converter"  convert_ve_plugin
    
      79  install -Dvm755  "${srcdir}/uup-converter.sh"   "${pkgdir}/usr/bin/uup-converter"
    
      80
    
      81  _docfiles=(
    
      82    "${srcdir}/git.log"
    
      83    readme.md
    
      84  )
    
      85  _docdirs=()
    
      86  _manfiles=()
    
      87  _infofiles=()
    
      88  _licensefiles=(
    
      89    LICENSE
    
      90  )
    
      91  printf '%s\n' " --> installing documentation ..."
    
      92  for _docfile in "${_docfiles[@]}"; do
    
      93    install -D -v -m644 "${_docfile}" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_docfile}")"
    
      94  done
    
      95  for _docdir in "${_docdirs[@]}"; do
    
      96    cp -rv "${_docdir}" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_docdir}")"
    
      97  done
    
      98  for _manfile in "${_manfiles[@]}"; do
    
      99    _section="$(basename "${_manfile}" .gz | sed -E -e 's|^.*\.([^.]*)$|\1|')"
    
      100    install -D -v -m644 "docs/build/man/${_manfile}" "${pkgdir}/usr/share/man/man${_section}/$(basename "${_manfile}")"
    
      101  done
    
      102  for _infofile in "${_infofiles[@]}"; do
    
      103    install -D -v -m644 "${_infofile}" "${pkgdir}/usr/share/info/$(basename "${_infofile}")"
    
      104  done
    
      105  printf '%s\n' " --> installing license ..."
    
      106  for _licensefile in "${_licensefiles[@]}"; do
    
      107    install -D -v -m644 "${_licensefile[@]}" "${pkgdir}/usr/share/licenses/${pkgname}/$(basename "${_licensefile}")"
    
      108    ln -svr "${pkgdir}/usr/share/licenses/${pkgname}/$(basename "${_licensefile}")" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_licensefile}")"
    
      109  done
    
      110}
    
      111

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2