victoriametrics-cluster

maintainer k0ste · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is downloaded from GitHub's official codeload domain, which is a standard and trusted source for project releases, even though it is flagged for using a non-standard host pattern; the package builds from verified source code and does not execute untrusted binaries or remote code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is downloaded from GitHub's official codeload domain, which is a standard and trusted source for project releases, even though it is flagged for using a non-standard host pattern; the package builds from verified source code and does not execute untrusted binaries or remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("${pkgname}-${pkgver}.tar.gz::https://codeload.${_uri}/${_name_camel}/tar.gz/refs/tags/v${pkgver}-cluster"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Shalygin Konstantin <k0ste@k0ste.ru>
    
      2# Contributor: Shalygin Konstantin <k0ste@k0ste.ru>
    
      3
    
      4_name="victoriametrics"
    
      5_name_camel="VictoriaMetrics"
    
      6pkgname="${_name}-cluster"
    
      7pkgver='1.148.0'
    
      8pkgrel='1'
    
      9pkgdesc='Fast, cost-effective monitoring solution and time series database'
    
      10arch=('x86_64' 'aarch64')
    
      11_uri="github.com/${_name_camel}"
    
      12url="https://${_uri}/${_name_camel}"
    
      13license=('Apache')
    
      14makedepends=('go' 'git')
    
      15conflicts=("${_name}-agent" "${_name}-bin" "${_name}" 'vmutils')
    
      16source=("${pkgname}-${pkgver}.tar.gz::https://codeload.${_uri}/${_name_camel}/tar.gz/refs/tags/v${pkgver}-cluster"
    
      17	"vmauth"
    
      18	"vmauth.service"
    
      19	"vminsert"
    
      20	"vminsert.service"
    
      21	"vmselect"
    
      22	"vmselect.service"
    
      23	"vmstorage"
    
      24	"vmstorage.service"
    
      25	"vmauth.yml"
    
      26	"${_name}.sysusers"
    
      27	"${_name}.tmpfiles")
    
      28sha256sums=('6cc114480a7578f5052d9788c6bbc6e87a171549656d0563ba05842517455530'
    
      29            '459b40675c3b77b108a597e864d29b72c93870a0ef0d814d8a99f0c293addd54'
    
      30            'd08557b61879cc854287bab39a62a176c54c752a3bf2bf71d42b1c27a645a571'
    
      31            '5144d6cb0732ae7d12e92ec4e13c36f3373407b7f826c44aedff6da50dd8d17a'
    
      32            '54d02bdcd61a9b6a48cd2ee6ef08406090a200b3a35ab216f1b151eb1424bcb5'
    
      33            'ce3710d24588c6c7d664efc4a94d7a90db81fa5c3ba1444c81914e5a8f9e0f02'
    
      34            '040b41b8ef4e16ed2b3bf50d9d3508b8b2808466c3e7c5b6517125088cca7e52'
    
      35            'a332a723a399b8541fad9cb3450cc85d6fdcf8140f389360867958138657a6bf'
    
      36            'b205da7569af860f81138b6a77f984e82480644e0828b7ed5f4b5c41a68d8403'
    
      37            '75cb2f253312d814a0418e45e9c430f3ea392720b912f4c7d15a1093ba338415'
    
      38            '82d36f90fe6eacde11b387cd3537d049bb67292e2dd0b5c95b555c020e199980'
    
      39            'eb972939dace3a330c7be1bd0e0f7a9fb3d9ca449326d4eeac5c208af376a84c')
    
      40backup=("etc/${_name}/vmauth.yml"
    
      41        "etc/conf.d/vmauth"
    
      42        "etc/conf.d/vminsert"
    
      43        "etc/conf.d/vmselect"
    
      44        "etc/conf.d/vmstorage")
    
      45
    
      46prepare() {
    
      47  export GOPATH="${srcdir}/gopath"
    
      48  export GOBIN="${GOPATH}/bin"
    
      49  export GOCACHE="${srcdir}/cache/go-cache"
    
      50  export GOMODCACHE="${srcdir}/cache/go"
    
      51  export GOTMPDIR="${srcdir}"
    
      52  eval "$(go env | grep -e "GOHOSTOS" -e "GOHOSTARCH")"
    
      53  mkdir -p "${GOPATH}/src/${_uri}"
    
      54  ln -snf "${srcdir}/${_name_camel}-${pkgver}-cluster" \
    
      55  "${GOPATH}/src/${_uri}/${_name}"
    
      56}
    
      57
    
      58build() {
    
      59  cd "${GOPATH}/src/${_uri}/${_name}"
    
      60  eval "$(go env | grep -e "GOHOSTOS" -e "GOHOSTARCH")"
    
      61  export GOOS="${GOHOSTOS}"
    
      62  export GOARCH="${GOHOSTARCH}"
    
      63
    
      64  for app in "vmagent" "vmalert" "vmauth" "vmbackup" "vmctl" "vminsert" \
    
      65"vmrestore" "vmselect" "vmstorage"
    
      66  do
    
      67    go build -x \
    
      68      -buildmode="pie" \
    
      69      -trimpath \
    
      70      -mod="readonly" \
    
      71      -modcacherw \
    
      72      -ldflags "-linkmode external -extldflags '${LDFLAGS}' \
    
      73      -X ${_uri}/${_name_camel}/lib/buildinfo.Version=${pkgver}-${pkgrel}" \
    
      74      -o "bin/${app}" "./app/${app}"
    
      75  done
    
      76}
    
      77
    
      78check() {
    
      79  cd "${GOPATH}/src/${_uri}/${_name}"
    
      80  eval "$(go env | grep -e "GOHOSTOS" -e "GOHOSTARCH")"
    
      81  GOOS="${GOHOSTOS}" GOARCH="${GOHOSTARCH}" \
    
      82    DISABLE_FSYNC_FOR_TESTING=1 go test -modcacherw ./lib/... ./app/...
    
      83}
    
      84
    
      85package() {
    
      86  for app in "vmagent" "vmalert" "vmauth" "vmbackup" "vmctl" "vminsert" \
    
      87"vmrestore" "vmselect" "vmstorage"
    
      88    do
    
      89      install -Dm0755 "${_name_camel}-${pkgver}-cluster/bin/${app}" -t "${pkgdir}/usr/bin"
    
      90  done
    
      91
    
      92  for app in "vmauth" "vminsert" "vmselect" "vmstorage"
    
      93    do
    
      94      install -Dm0644 "${app}.service" -t "${pkgdir}/usr/lib/systemd/system"
    
      95      install -Dm0644 "${app}" -t "${pkgdir}/etc/conf.d"
    
      96  done
    
      97
    
      98  install -Dm0644 "${GOPATH}/src/${_uri}/${_name}/LICENSE" -t \
    
      99"${pkgdir}/usr/share/licenses/${_name}"
    
      100  install -Dm0644 "vmauth.yml" -t "${pkgdir}/etc/${_name}"
    
      101  install -Dm0644 "${_name}.sysusers" "${pkgdir}/usr/lib/sysusers.d/${_name}.conf"
    
      102  install -Dm0644 "${_name}.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/${_name}.conf"
    
      103}
    
      104

Changes since previous scan

--- PKGBUILD @ 2026-07-23 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -4,7 +4,7 @@
 _name="victoriametrics"
 _name_camel="VictoriaMetrics"
 pkgname="${_name}-cluster"
-pkgver='1.146.0'
+pkgver='1.148.0'
 pkgrel='1'
 pkgdesc='Fast, cost-effective monitoring solution and time series database'
 arch=('x86_64' 'aarch64')
@@ -25,7 +25,7 @@
 	"vmauth.yml"
 	"${_name}.sysusers"
 	"${_name}.tmpfiles")
-sha256sums=('377fbe1c12bcc01011821ad04e88ff5731ffd1ce2d303de485f06ba0b05f62c5'
+sha256sums=('6cc114480a7578f5052d9788c6bbc6e87a171549656d0563ba05842517455530'
             '459b40675c3b77b108a597e864d29b72c93870a0ef0d814d8a99f0c293addd54'
             'd08557b61879cc854287bab39a62a176c54c752a3bf2bf71d42b1c27a645a571'
             '5144d6cb0732ae7d12e92ec4e13c36f3373407b7f826c44aedff6da50dd8d17a'

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 13:24:23	MEDIUM	1
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2