victoriametrics-cluster
LOW
maintainer k0ste
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The source is downloaded from GitHub's official codeload domain, which hosts legitimate tarballs from the project's repository; building from this source is standard practice and not inherently dangerous.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is downloaded from GitHub's official codeload domain, which hosts legitimate tarballs from the project's repository; building from this source is standard practice and not inherently dangerous.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
source=("${pkgname}-${pkgver}.tar.gz::https://codeload.${_uri}/${_name_camel}/tar.gz/refs/tags/v${pkgver}-cluster"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Shalygin Konstantin <k0ste@k0ste.ru>
2
# Contributor: Shalygin Konstantin <k0ste@k0ste.ru>
3
4
_name="victoriametrics"
5
_name_camel="VictoriaMetrics"
6
pkgname="${_name}-cluster"
7
pkgver='1.150.0'
8
pkgrel='1'
9
pkgdesc='Fast, cost-effective monitoring solution and time series database'
10
arch=('x86_64' 'aarch64')
11
_uri="github.com/${_name_camel}"
12
url="https://${_uri}/${_name_camel}"
13
license=('Apache')
14
makedepends=('go' 'git')
15
conflicts=("${_name}-agent" "${_name}-bin" "${_name}" 'vmutils')
16
source=("${pkgname}-${pkgver}.tar.gz::https://codeload.${_uri}/${_name_camel}/tar.gz/refs/tags/v${pkgver}-cluster"
17
"vmauth"
18
"vmauth.service"
19
"vminsert"
20
"vminsert.service"
21
"vmselect"
22
"vmselect.service"
23
"vmstorage"
24
"vmstorage.service"
25
"vmauth.yml"
26
"${_name}.sysusers"
27
"${_name}.tmpfiles")
28
sha256sums=('cea8f9eb86bc3673c743592770e9f81908f842a443f1ec286a02b1ca4f3576a0'
29
'459b40675c3b77b108a597e864d29b72c93870a0ef0d814d8a99f0c293addd54'
30
'd08557b61879cc854287bab39a62a176c54c752a3bf2bf71d42b1c27a645a571'
31
'5144d6cb0732ae7d12e92ec4e13c36f3373407b7f826c44aedff6da50dd8d17a'
32
'54d02bdcd61a9b6a48cd2ee6ef08406090a200b3a35ab216f1b151eb1424bcb5'
33
'ce3710d24588c6c7d664efc4a94d7a90db81fa5c3ba1444c81914e5a8f9e0f02'
34
'040b41b8ef4e16ed2b3bf50d9d3508b8b2808466c3e7c5b6517125088cca7e52'
35
'a332a723a399b8541fad9cb3450cc85d6fdcf8140f389360867958138657a6bf'
36
'b205da7569af860f81138b6a77f984e82480644e0828b7ed5f4b5c41a68d8403'
37
'75cb2f253312d814a0418e45e9c430f3ea392720b912f4c7d15a1093ba338415'
38
'82d36f90fe6eacde11b387cd3537d049bb67292e2dd0b5c95b555c020e199980'
39
'eb972939dace3a330c7be1bd0e0f7a9fb3d9ca449326d4eeac5c208af376a84c')
40
backup=("etc/${_name}/vmauth.yml"
41
"etc/conf.d/vmauth"
42
"etc/conf.d/vminsert"
43
"etc/conf.d/vmselect"
44
"etc/conf.d/vmstorage")
45
46
prepare() {
47
export GOPATH="${srcdir}/gopath"
48
export GOBIN="${GOPATH}/bin"
49
export GOTMPDIR="${GOPATH}/tmp"
50
export GOCACHE="${srcdir}/cache/go-cache"
51
export GOMODCACHE="${srcdir}/cache/go"
52
mkdir -p "${GOPATH}/src/${_uri}"
53
mkdir -p "${GOTMPDIR}"
54
eval "$(go env | grep -e "GOHOSTOS" -e "GOHOSTARCH")"
55
mkdir -p "${GOPATH}/src/${_uri}"
56
ln -snf "${srcdir}/${_name_camel}-${pkgver}-cluster" \
57
"${GOPATH}/src/${_uri}/${_name}"
58
}
59
60
build() {
61
cd "${GOPATH}/src/${_uri}/${_name}"
62
eval "$(go env | grep -e "GOHOSTOS" -e "GOHOSTARCH")"
63
export GOOS="${GOHOSTOS}"
64
export GOARCH="${GOHOSTARCH}"
65
66
for app in "vmagent" "vmalert" "vmauth" "vmbackup" "vmctl" "vminsert" \
67
"vmrestore" "vmselect" "vmstorage"
68
do
69
go build -x \
70
-buildmode="pie" \
71
-trimpath \
72
-mod="readonly" \
73
-modcacherw \
74
-ldflags "-linkmode external -extldflags '${LDFLAGS}' \
75
-X ${_uri}/${_name_camel}/lib/buildinfo.Version=${pkgver}-${pkgrel}" \
76
-o "bin/${app}" "./app/${app}"
77
done
78
}
79
80
check() {
81
cd "${GOPATH}/src/${_uri}/${_name}"
82
eval "$(go env | grep -e "GOHOSTOS" -e "GOHOSTARCH")"
83
TMPDIR="${GOPATH}/tmp" GOOS="${GOHOSTOS}" GOARCH="${GOHOSTARCH}" \
84
DISABLE_FSYNC_FOR_TESTING=1 go test -modcacherw ./lib/... ./app/...
85
}
86
87
package() {
88
for app in "vmagent" "vmalert" "vmauth" "vmbackup" "vmctl" "vminsert" \
89
"vmrestore" "vmselect" "vmstorage"
90
do
91
install -Dm0755 "${_name_camel}-${pkgver}-cluster/bin/${app}" -t "${pkgdir}/usr/bin"
92
done
93
94
for app in "vmauth" "vminsert" "vmselect" "vmstorage"
95
do
96
install -Dm0644 "${app}.service" -t "${pkgdir}/usr/lib/systemd/system"
97
install -Dm0644 "${app}" -t "${pkgdir}/etc/conf.d"
98
done
99
100
install -Dm0644 "${GOPATH}/src/${_uri}/${_name}/LICENSE" -t \
101
"${pkgdir}/usr/share/licenses/${_name}"
102
install -Dm0644 "vmauth.yml" -t "${pkgdir}/etc/${_name}"
103
install -Dm0644 "${_name}.sysusers" "${pkgdir}/usr/lib/sysusers.d/${_name}.conf"
104
install -Dm0644 "${_name}.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/${_name}.conf"
105
}
106
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |