virt-v2v

LOW

maintainer solsticedhiver 4 votes scanned 2026-11-06 00:21:40.447623

View on AUR

Why flagged

The source is a legitimate project tarball from the official libguestfs download domain, despite not being on a standard code host; it is not an executable or unverifiable payload, and the checksums are provided and valid.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a legitimate project tarball from the official libguestfs download domain, despite not being on a standard code host; it is not an executable or unverifiable payload, and the checksums are provided and valid.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source=("https://download.libguestfs.org/virt-v2v/${pkgver%.*}-${_dirname}/virt-v2v-${pkgver}.tar.gz" "virt-v2v.install")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: solstiCe d'Hiver <solstice.dhiver@gmail.com>
    
      2pkgname=virt-v2v
    
      3pkgver=2.12.0
    
      4pkgrel=1
    
      5pkgdesc="Convert a guest image to use with KVM"
    
      6arch=(x86_64)
    
      7url="https://libguestfs.org/virt-v2v.1.html"
    
      8license=('GPL-2.0-or-later')
    
      9depends=('libguestfs' 'libosinfo' 'libnbd' 'nbdkit')
    
      10makedepends=('ocaml' 'ocaml-findlib' 'ocaml-libvirt' 'ocaml-libguestfs' 'perl-ipc-run3')
    
      11options=('!ccache')
    
      12# ocaml-libvirt 0.6.1.5 is broken, use ocaml-libvirt-git
    
      13optdepends=('mingw-w64-rhsrvany: for Windows based VM'
    
      14	'virtio-win: for windows based VM')
    
      15
    
      16# dirty hack to deal with both stable and dev version
    
      17_minor=`echo $pkgver|awk -F. '{print $2}'`
    
      18_dirname='stable'
    
      19if [[ `expr $_minor % 2` -eq 1 ]]; then
    
      20	_dirname='development'
    
      21fi
    
      22
    
      23source=("https://download.libguestfs.org/virt-v2v/${pkgver%.*}-${_dirname}/virt-v2v-${pkgver}.tar.gz" "virt-v2v.install")
    
      24install=virt-v2v.install
    
      25
    
      26sha256sums=('6032d86f75f20419539e70c7c905f8c9a664b738eb086f4012f653ef933504dc'
    
      27            '6235d47396e8e193a80de17825fe337f18ab0bb6ffb4a61f204bea57e5a90f7d')
    
      28
    
      29build() {
    
      30	cd "$pkgname-$pkgver"
    
      31	./configure --prefix=/usr
    
      32	make
    
      33}
    
      34
    
      35# some tests are still failling
    
      36#check() {
    
      37#	cd "$pkgname-$pkgver"
    
      38#	make -k check
    
      39#}
    
      40
    
      41package() {
    
      42	cd "$pkgname-$pkgver"
    
      43	make DESTDIR="$pkgdir/" install
    
      44}
    
      45

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-11-06 00:21
@@ -1,6 +1,6 @@
 # Maintainer: solstiCe d'Hiver <solstice.dhiver@gmail.com>
 pkgname=virt-v2v
-pkgver=2.10.0
+pkgver=2.12.0
 pkgrel=1
 pkgdesc="Convert a guest image to use with KVM"
 arch=(x86_64)
@@ -23,7 +23,7 @@
 source=("https://download.libguestfs.org/virt-v2v/${pkgver%.*}-${_dirname}/virt-v2v-${pkgver}.tar.gz" "virt-v2v.install")
 install=virt-v2v.install
 
-sha256sums=('0cd703d872fac81ed6358462a0c1f50de0db5b70240f31e203e1d82c999d12cc'
+sha256sums=('6032d86f75f20419539e70c7c905f8c9a664b738eb086f4012f653ef933504dc'
             '6235d47396e8e193a80de17825fe337f18ab0bb6ffb4a61f204bea57e5a90f7d')
 
 build() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-06 00:21:40	Low	2
2026-11-06 00:11:05	Medium	1
2026-06-19 19:07:35	Clean	2
2026-06-18 18:55:24	Clean	2
2026-06-18 16:11:54	Medium	1