ceph-common 20.2.4-1
Ceph Storage common libraries and dependencies
config.json file.
/v1/packages/ceph-common/versions SHAs are authoritative.
Metadata
Relations
Depends
Make dependencies
Provides
Security
Revision scans
| Revision | Status | Scanned | Findings |
|---|---|---|---|
| 1e17d7fa6758head | verified | 2026-11-05 16:16 | 24 |
| 48c36023b5f6 | verified | 2026-11-05 16:16 | 24 |
Head findings
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
export CMAKE_BUILD_PARALLEL_LEVEL=$(nproc --ignore=1 || echo "4")
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
ctest -j $(nproc --ignore=1 || echo "4") \
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
mkdir -p "$(dirname "$d")"
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
rmdir -p --ignore-fail-on-non-empty "$(dirname "$f")"
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
pyv=$(python -c 'import sys ; v = sys.version_info ; print("%d.%d" %(v[0], v[1]))')command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
local -i _ret=$(find "${install}" -type f,l | wc -l)command-substitution
in
scripts.gh-upload-artifact.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
--token | The API token to use when authenticating with GitHub env:\$GITHUB_TOKEN =$([[-n "$token" ]] && printf '<*****>' || printf '<unset>')
command-substitution
in
scripts.gh-upload-artifact.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
1. $(basename $0) --tag=v1.0.0 --repo github/octocat --file ./cute-kat.jpg --token=dae3re34...
command-substitution
in
scripts.gh-upload-artifact.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
2. GITHUB_TOKEN=4wf4dec... GITHUB_ARTIFACT=/assets/cats.json $(basename $0) --repo=github/octocat --tag=v2.0.0
command-substitution
in
scripts.gh-upload-artifact.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
3. $(basename $0) --tag=@ --repo github/octocat --file ./dirty_m3sszy.kitty.tar.xz:kitty.tar.xz --token f43rffe...
variable-indirection
in
scripts.gh-upload-artifact.shBash indirect variable expansion - the referenced variable is resolved at runtime and cannot be statically resolved.
[[ -n "${!v}" ]] || efails+=("$v")command-substitution
in
scripts.gh-upload-artifact.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
[[ -n "${efails}" ]] && emsg=$(printf 'Missing required variable(s): %s' "${efails[*]}")command-substitution
in
scripts.gh-upload-artifact.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
[[ -n "${xfails}" ]] && emsg=$(printf '%s\nMissing required executable(s): %s' "$emsg" "${xfails[*]}")command-substitution
in
scripts.gh-upload-artifact.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
[[ -n "$emsg" ]] && die 3 "$(printf '%s\n[INFO]: Use --help for more information' "$emsg")"
command-substitution
in
scripts.gh-upload-artifact.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
local GOPTS=$(getopt -o hd --long help,dry-run,repo:,tag:,file:,token: -n "gh-upload-artifact" -- "$@")
command-substitution
in
scripts.gh-upload-artifact.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
[[ -n "$filename" ]] || filename=$(basename $artifact)
command-substitution
in
scripts.gh-upload-artifact.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
GH_RESPONSE=$(mktemp)
risky-tool
in
scripts.gh-upload-artifact.sh'curl' is invoked - this fetches/executes external code outside alpm's control.
curl "$CURL_ARGS" -o "$GH_RESPONSE" -H "$GH_AUTH" "https://api.github.com/repos/$repo/releases/$GH_TAG"
command-substitution
in
scripts.gh-upload-artifact.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
(( $? > 0 )) && die 1 "$(cat <(printf "Invalid repo, token or network issue!\n") $GH_RESPONSE)"
command-substitution
in
scripts.gh-upload-artifact.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
id=$(jq -r '.id' "$GH_RESPONSE")
command-substitution
in
scripts.gh-upload-artifact.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
(( $? > 0 )) && die 1 "$(cat <(printf "Failed to get release id for tag '%s' from response:\n" "$tag") $GH_RESPONSE)"
risky-tool
in
scripts.gh-upload-artifact.sh'curl' is invoked - this fetches/executes external code outside alpm's control.
curl "$CURL_ARGS" \
command-substitution
in
scripts.gh-upload-artifact.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
-H "Content-Type: $(file -b --mime-type $artifact)" \
command-substitution
in
scripts.gh-upload-artifact.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
&& die 1 "$(cat <(printf "Failed to upload $filename to $repo:\n") $GH_RESPONSE)" \
Findings below High severity are retained for review but do not block serving. Verified means no obvious red flags from static analysis - never a guarantee that a package is safe.