xpt

LOW

maintainer juanvel400 1 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

Source tarball is fetched from the maintainer's personal domain (dl.juanvel400.com) rather than an official forge, making it unverifiable by a third party, but it has a sha256 checksum, builds from source with meson, and the project URL points to a plausible sr.ht project page; the main risk is that the personal download host could be swapped silently, but there is no obfuscation, no remote code execution, and no prebuilt binary being run directly.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 60%): Source tarball is fetched from the maintainer's personal domain (dl.juanvel400.com) rather than an official forge, making it unverifiable by a third party, but it has a sha256 checksum, builds from source with meson, and the project URL points to a plausible sr.ht project page; the main risk is that the personal download host could be swapped silently, but there is no obfuscation, no remote code execution, and no prebuilt binary being run directly.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://dl.juanvel400.com/$pkgname/$pkgname-$pkgver.tar.xz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: juanvel400 <me@juanvel400.com>
    
      2pkgname=xpt
    
      3pkgver=0.12.0
    
      4pkgrel=1
    
      5pkgdesc="a package-management suite for .xpt packages"
    
      6arch=('x86_64')
    
      7url="https://sr.ht/~juanvel400/xpt"
    
      8license=('BSD-3-Clause')
    
      9depends=(openssl libarchive zstd sqlite3)
    
      10makedepends=(pkg-config meson ninja)
    
      11source=("https://dl.juanvel400.com/$pkgname/$pkgname-$pkgver.tar.xz")
    
      12sha256sums=('9d9a2faa9f49acb91b09218f0e24574d0017917bdb32d3ac92ef93211e575476')
    
      13
    
      14build() {
    
      15    cd "$pkgname-$pkgver"
    
      16    meson setup build --prefix=/usr --sysconfdir=/etc --localstatedir=/var --buildtype=release -Ddoxygen=disabled
    
      17    meson compile -C build
    
      18}
    
      19
    
      20check() {
    
      21    cd "$pkgname-$pkgver"
    
      22    meson test -C build
    
      23}
    
      24
    
      25package() {
    
      26    cd "$pkgname-$pkgver"
    
      27    meson install -C build --destdir="$pkgdir/"
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	3
2026-10-16 19:20:10	Low	3
2026-10-16 19:16:12	Medium	2