astah-professional

maintainer jflake · 19 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt .deb from the official vendor's CDN (change-vision.com), which is plausibly the project's own infrastructure; while the host is not whitelisted, the .deb is from the official vendor and contains only installable data, not an obfuscated payload or remote code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from the official vendor's CDN (change-vision.com), which is plausibly the project's own infrastructure; while the host is not whitelisted, the .deb is from the official vendor and contains only installable data, not an obfuscated payload or remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("https://cdn.change-vision.com/files/astah-professional_${pkgver}.${_pkgrel}-0_all.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Julian Flake <flake_at_uni-koblenz_dot_de>
    
      2# Contributor: Sebastian Lau <lauseb644 _at_ gmail _dot_ com>
    
      3# Contributor: Caleb Cushing <xenoterracide@gmail.com>
    
      4# Contributor: Romain Schmitz <slopjong .at. slopjong .dot. de>
    
      5# Forked from Phillipe Smith <phillipe@archlinux.com.br>
    
      6
    
      7pkgname='astah-professional'
    
      8_pkgname=${pkgname//-/_}
    
      9pkgver='10.1.0'
    
      10_pkgver=${pkgver//./_}
    
      11pkgrel=1
    
      12_pkgrel=9ceee1
    
      13pkgdesc='Full-Featured Software Modeling Tool for creating UML, ER Diagrams, DFD, Flowchart and more to create a clear understanding of your software design among teams.Easy-to-use UML2.x modeler'
    
      14arch=('any')
    
      15url="http://astah.net/products/astah-professional"
    
      16conflicts=('astah_community' 'astah-uml')
    
      17license=('custom')
    
      18depends=('jre21-openjdk')
    
      19source=("https://cdn.change-vision.com/files/astah-professional_${pkgver}.${_pkgrel}-0_all.deb"
    
      20	"LICENSE"
    
      21	"PRIVACY")
    
      22md5sums=('73fd8f692f3977d5721e9afc43a3f572'
    
      23         '4667d0dfa5bde4924e3cea64fb310e94'
    
      24         'd041a1336f18d00a99baa330b0e25fb9')
    
      25install="astah-professional.install"
    
      26
    
      27
    
      28package() {
    
      29    msg2 "Extracting the data.tar.xz..."
    
      30    bsdtar -xf $srcdir/data.tar.xz -C "$pkgdir/"
    
      31
    
      32    #  rm -r ${pkgdir}/usr/share/doc
    
      33    install -Dm644 $srcdir/LICENSE ${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE || return 1
    
      34    install -Dm644 $srcdir/PRIVACY ${pkgdir}/usr/share/licenses/${_pkgname}/PRIVACY || return 1
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2