ahformatter

maintainer luisamiralles · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt binary from a locally bundled RPM file with a SKIP'd checksum on the x86_64 source, which is unverifiable and could be tampered with, representing a supply-chain risk.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package installs a prebuilt binary from a locally bundled RPM file with a SKIP'd checksum on the x86_64 source, which is unverifiable and could be tampered with, representing a supply-chain risk.

PKGBUILD

      1# Maintainer:  Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
    
      2
    
      3_Name="AHFormatter"
    
      4pkgbase="${_Name,,}"
    
      5pkgname=(
    
      6  "${pkgbase}"
    
      7  "java-${pkgbase}"
    
      8)
    
      9pkgver=7.5.1.69020
    
      10_pkgver="$(awk -F. '{print $1 "." $2}' <<< "$pkgver")"
    
      11pkgrel=1
    
      12pkgdesc="Proprietary publishing engine. Generate PDF from XML or HTML. Format with XSL-FO or CSS."
    
      13arch=(
    
      14  'x86_64'
    
      15)
    
      16url="https://www.antennahouse.com/formatter-v${pkgver%%.*}"
    
      17license=(
    
      18  'custom:Antenna House EULA'
    
      19)
    
      20_pkgsrc="${pkgbase}-${_pkgver}"
    
      21source=(
    
      22  "${pkgbase}.sh"
    
      23)
    
      24source_x86_64=(
    
      25  "local://${_Name}V${_pkgver/./}-${_pkgver}E-R1.x86_64.rpm.gz"
    
      26)
    
      27sha256sums=('aa96daa7313fecdf5188978fd5e1b7611250975165b91aa1f25d640e37ed569d')
    
      28sha256sums_x86_64=('SKIP')
    
      29
    
      30prepare() {
    
      31  cd "${srcdir}"
    
      32  mkdir -p "${_pkgsrc}-${CARCH}"
    
      33  bsdtar -xf "${_Name}V${_pkgver/./}-${_pkgver}E-R1.${CARCH}.rpm" --strip-components 3 -C "${srcdir}/${_pkgsrc}-${CARCH}"
    
      34
    
      35  sed -e "s/@@VERSION@@/${_pkgver//.}/g" \
    
      36      -i "${pkgbase}.sh"
    
      37
    
      38  cd "${_pkgsrc}-${CARCH}/etc"
    
      39  sed -i '/<font-folder path="@@HOME@@\/fonts">/c\
    
      40  <font-folder path="/usr/share/ahformatter/fonts">' font-config.xml
    
      41  sed -i '/<\/font-folder>/a\
    
      42  <font-folder path="@@HOME@@/.local/share/fonts" recursive="true"/>\
    
      43  <font-folder path="/usr/share/fonts" recursive="true"/>' font-config.xml
    
      44}
    
      45
    
      46pkgver() {
    
      47  cd "${srcdir}/${_pkgsrc}-${CARCH}/etc"
    
      48  sed -n 's|.*<entry key="build">\([^<]*\)</entry>.*|\1|p' version.xml
    
      49}
    
      50
    
      51package_ahformatter() {
    
      52  depends=(
    
      53    'gcc-libs'
    
      54    'glibc'
    
      55    'icu76'
    
      56    'sh'
    
      57    'util-linux-libs'
    
      58  )
    
      59  optdepends=(
    
      60    "java-${pkgbase}: Java bindings"
    
      61  )
    
      62  provides=(
    
      63    'libAHCGM.so'
    
      64    'libAHCommon.so'
    
      65    'libAHFontService.so'
    
      66    'libAHGraphicService.so'
    
      67    'libAHMathML.so'
    
      68    'libAHPDFLib.so'
    
      69    'libAHRasterizer.so'
    
      70    'libAHskia.so'
    
      71    'libAHSVG.so'
    
      72    'libOOXMLCreator.so'
    
      73    'libPDFCreator.so'
    
      74    'libPDFLinearizer.so'
    
      75    'libPDFRes.so'
    
      76    'libPDFToolPage.so'
    
      77    'libPSCreator.so'
    
      78    'libSVGCreator.so'
    
      79    'libXfoCommon.so'
    
      80    'libXfoEngine.so'
    
      81    'libXfoFont.so'
    
      82    'libXfoGraphic.so'
    
      83    'libXfoHyphen.so'
    
      84    'libXfoInterface.so'
    
      85    'libXfoRender.so'
    
      86    'libXfoText.so'
    
      87    'libXfoTrans.so'
    
      88    'libXPSCreator.so'
    
      89  )
    
      90  backup=(
    
      91    "etc/${pkgbase}/font-config.xml"
    
      92    "etc/${pkgbase}/html.css"
    
      93  )
    
      94  install="${pkgbase}.install"
    
      95
    
      96  cd "${srcdir}"
    
      97  install -vDm755 "${pkgbase}.sh" "${pkgdir}/usr/bin/AHFCmd"
    
      98  
    
      99  cd "${_pkgsrc}-${CARCH}"
    
      100  find "bin" -type f -execdir \
    
      101    install -vDm755 "{}" "${pkgdir}/usr/lib/${pkgbase}/{}" \;
    
      102  find "fonts" -type f -exec \
    
      103    install -vDm644 "{}" "${pkgdir}/usr/share/${pkgbase}/{}" \;
    
      104  find "include" -type f -exec \
    
      105    install -vDm644 "{}" "${pkgdir}/usr/{}" \;
    
      106
    
      107  install -vd "${pkgdir}/usr/lib"
    
      108  find "lib" -type f,l \( -name 'lib*.so*' ! -name 'libicu*' ! -name "libXfoJavaCtl${_pkgver//.}.so" \) -execdir \
    
      109    cp -va "{}" "${pkgdir}/usr/lib/{}" \;
    
      110
    
      111  install -vDm644 "ReadMe.txt" "${pkgdir}/usr/share/doc/${pkgbase}/README.txt"
    
      112  install -vDm644 "EULA.txt"   "${pkgdir}/usr/share/licenses/${pkgbase}/EULA.txt"
    
      113
    
      114  cd "${srcdir}/${_pkgsrc}-${CARCH}/docs"
    
      115  find . -type f -exec \
    
      116    install -Dm644 "{}" "${pkgdir}/usr/share/doc/${pkgbase}/html/{}" \;
    
      117
    
      118  cd "${srcdir}/${_pkgsrc}-${CARCH}/etc"
    
      119  find . -type f ! -name "${_Name}.lic" -exec \
    
      120    install -vDm644 "{}" "${pkgdir}/etc/${pkgbase}/{}" \;
    
      121}
    
      122
    
      123package_java-ahformatter() {
    
      124  pkgdesc+=" (Java bindings)"
    
      125  depends=(
    
      126    "${pkgbase}>=${pkgver}-${pkgrel}"
    
      127    'gcc-libs'
    
      128    'glibc'
    
      129    'java-runtime>=8'
    
      130  )
    
      131  provides=(
    
      132    "libXfoJavaCtl${_pkgver/.}.so"
    
      133  )
    
      134
    
      135  cd "${srcdir}/${_pkgsrc}-${CARCH}/lib"
    
      136  install -vDm644 "libXfoJavaCtl${_pkgver/.}.so" "${pkgdir}/usr/lib/libXfoJavaCtl${_pkgver/.}.so"
    
      137
    
      138  find . -type f -name '*.jar' -exec \
    
      139    install -vDm644 "{}" "${pkgdir}/usr/share/java/${pkgbase}/{}" \;
    
      140}
    
      141

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0