ardor

maintainer mart-e · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a source archive from the project's official vendor domain (jelurida.com), which is plausibly the project's own infrastructure, and installs it without executing arbitrary remote code, making the risk low despite the non-whitelisted host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source archive from the project's official vendor domain (jelurida.com), which is plausibly the project's own infrastructure, and installs it without executing arbitrary remote code, making the risk low despite the non-whitelisted host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 https://www.jelurida.com/ardor-client.zip

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Martin Trigaux <me@mart-e.be>
    
      2pkgname=ardor
    
      3pkgver=2.3.3
    
      4pkgrel=1
    
      5pkgdesc="The Ardor Reference Software Client for use with the Ardor Blockchain Platform."
    
      6arch=()
    
      7url="https://www.ardorplatform.org"
    
      8license=('MIT/GPL')
    
      9arch=(any)
    
      10makedepends=(unzip)
    
      11depends=('jre8-openjdk')
    
      12install=$pkgname.install
    
      13source=(
    
      14	https://www.jelurida.com/ardor-client.zip
    
      15	ardor.service
    
      16)
    
      17sha256sums=(
    
      18	'6546e3d8d192c580430de30fdb55d4c552ce0fb27eb4199a462dff7225209eb5'
    
      19	'7b044d914d07f31d97746d9e5438dbcfedcd2e81e8acadb4c96dd315f2ce4862'
    
      20)
    
      21
    
      22package() {
    
      23	mkdir -p $pkgdir/opt/$pkgname
    
      24	mkdir -p $pkgdir/usr/bin
    
      25	cp -rf $pkgname $pkgdir/opt
    
      26
    
      27	echo "#!/bin/sh" > $pkgdir/usr/bin/ardor
    
      28	echo "cd /opt/ardor && bash run.sh" >> $pkgdir/usr/bin/ardor
    
      29	echo "#!/bin/sh" > $pkgdir/usr/bin/ardor-tor
    
      30	echo "cd /opt/ardor && bash run-tor.sh" >> $pkgdir/usr/bin/ardor-tor
    
      31
    
      32	install -Dm644 "${srcdir}"/ardor.service "${pkgdir}"/usr/lib/systemd/system/ardor.service
    
      33
    
      34	chmod 755 $pkgdir/usr/bin/ardor
    
      35	chmod 755 $pkgdir/usr/bin/ardor-tor
    
      36	mkdir nxt_db
    
      37	chmod 777 -R $pkgdir/opt/ardor
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2