cups-gssapi 2:2.4.11-1
OpenPrinting CUPS - daemon package - with gssapi (kerberos) enabled
config.json file.
/v1/packages/cups-gssapi/versions SHAs are authoritative.
Metadata
Relations
Depends
Make dependencies
Optional dependencies
Conflicts
Provides
Security
Revision scans
| Revision | Status | Scanned | Findings |
|---|---|---|---|
| c41fd9ffb3bfhead | verified | 2026-11-05 16:04 | 6 |
Head findings
risky-tool
in
_create_package.sh'docker' is invoked - this fetches/executes external code outside alpm's control.
docker pull archlinux
command-substitution
in
_create_package.shDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
docker run --rm -e MAKEFLAGS -v "$(pwd):/source:ro" archlinux /source/_docker_validate.sh || (echo "[!] Failed to validate package using docker" && exit 1)
risky-tool
in
_create_package.sh'docker' is invoked - this fetches/executes external code outside alpm's control.
docker run --rm -e MAKEFLAGS -v "$(pwd):/source:ro" archlinux /source/_docker_validate.sh || (echo "[!] Failed to validate package using docker" && exit 1)
privilege-escalation
in
_docker_validate.shPrivilege escalation tool 'sudo' is invoked inside a packaged helper script - helper scripts only run when the user invokes them voluntarily, typically with the privileges they already hold.
exec sudo -u builduser "$0" "$@"
command-substitution
in
cups.installDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
if [[ $(vercmp 2.2.6-3 $2) = 1 ]]; then
command-substitution
in
cups.installDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
if [[ $(vercmp 2.3.3+105+g59137acc1-1 $2) = 1 ]]; then
Findings below High severity are retained for review but do not block serving. Verified means no obvious red flags from static analysis - never a guarantee that a package is safe.