uup-converter-git
LOW
maintainer dreieck
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package builds from a git repository on a non-whitelisted but plausibly project-owned host (git.uupdump.net), which is used by the project; this is normal AUR packaging behavior and not inherently dangerous.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a git repository on a non-whitelisted but plausibly project-owned host (git.uupdump.net), which is used by the project; this is normal AUR packaging behavior and not inherently dangerous.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:41
"${_pkgname}::git+https://${_githost}/${_gituser}/${_gitname}.git"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: dreieck (https://aur.archlinux.org/account/dreieck)
2
3
_gitname="converter"
4
_pkgname="uup-converter"
5
pkgname="${_pkgname}-git"
6
pkgver=0.7.3.r63.20251026.dbc65de
7
pkgrel=1
8
pkgdesc="A basic UUP converter aimed at Linux and macOS users who don't have access to any Windows machine, but want or need to create an ISO image for latest Windows Insider version downloaded from UUP dump (uupdump.net)."
9
groups=('uup-dump')
10
arch=(
11
'any'
12
)
13
_githost='git.uupdump.net'
14
_gituser='uup-dump'
15
url="https://${_githost}/${_gituser}/${_gitname}"
16
license=("MIT")
17
depends=(
18
'bash'
19
20
'aria2'
21
'cabextract'
22
'chntpw'
23
'findutils' # For 'find'
24
'grep'
25
'wimlib' # For 'wimlib-imagex'
26
27
'cdrtools' # 'genisoimage' or 'mkisofs' is needed by the script.
28
)
29
makedepends=(
30
'git'
31
)
32
optdepends=()
33
provides=(
34
"${_pkgname}=${pkgver}"
35
)
36
conflicts=(
37
"${_pkgname}"
38
)
39
40
source=(
41
"${_pkgname}::git+https://${_githost}/${_gituser}/${_gitname}.git"
42
"uup-converter.sh"
43
)
44
sha256sums=(
45
'SKIP'
46
'50f3218e9b89d6956ed3bac141fd80f6c93e54367ee94bb06392eb760358cac3'
47
)
48
49
prepare() {
50
cd "${srcdir}/${_pkgname}"
51
52
git log > "${srcdir}/git.log"
53
}
54
55
pkgver() {
56
cd "${srcdir}/${_pkgname}"
57
58
_ver="$(grep -E '^[[:space:]]*scriptName=' convert.sh | awk -F= '{print $2}' | tr -d \"\' | awk -F# '{print $1}' | sed -E 's|UUP Converter v||')"
59
#_ver="$(git describe --tags | sed -E -e 's|^[vV]||' -e 's|\-g[0-9a-f]*$||' | tr '-' '+')"
60
_rev="$(git rev-list --count HEAD)"
61
_date="$(git log -1 --date=format:"%Y%m%d" --format="%ad")"
62
_hash="$(git rev-parse --short HEAD)"
63
64
if [ -z "${_ver}" ]; then
65
error "Version could not be determined."
66
return 1
67
else
68
printf '%s' "${_ver}.r${_rev}.${_date}.${_hash}"
69
fi
70
}
71
72
73
package() {
74
cd "${srcdir}/${_pkgname}"
75
printf '%s\n' " --> installing ..."
76
77
install -Dvm755 -t "${pkgdir}/usr/lib/uup-converter" convert.sh
78
install -Dvm644 -t "${pkgdir}/usr/lib/uup-converter" convert_ve_plugin
79
install -Dvm755 "${srcdir}/uup-converter.sh" "${pkgdir}/usr/bin/uup-converter"
80
81
_docfiles=(
82
"${srcdir}/git.log"
83
readme.md
84
)
85
_docdirs=()
86
_manfiles=()
87
_infofiles=()
88
_licensefiles=(
89
LICENSE
90
)
91
printf '%s\n' " --> installing documentation ..."
92
for _docfile in "${_docfiles[@]}"; do
93
install -D -v -m644 "${_docfile}" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_docfile}")"
94
done
95
for _docdir in "${_docdirs[@]}"; do
96
cp -rv "${_docdir}" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_docdir}")"
97
done
98
for _manfile in "${_manfiles[@]}"; do
99
_section="$(basename "${_manfile}" .gz | sed -E -e 's|^.*\.([^.]*)$|\1|')"
100
install -D -v -m644 "docs/build/man/${_manfile}" "${pkgdir}/usr/share/man/man${_section}/$(basename "${_manfile}")"
101
done
102
for _infofile in "${_infofiles[@]}"; do
103
install -D -v -m644 "${_infofile}" "${pkgdir}/usr/share/info/$(basename "${_infofile}")"
104
done
105
printf '%s\n' " --> installing license ..."
106
for _licensefile in "${_licensefiles[@]}"; do
107
install -D -v -m644 "${_licensefile[@]}" "${pkgdir}/usr/share/licenses/${pkgname}/$(basename "${_licensefile}")"
108
ln -svr "${pkgdir}/usr/share/licenses/${pkgname}/$(basename "${_licensefile}")" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_licensefile}")"
109
done
110
}
111
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |