beersmith3

LOW

maintainer cadilhac 1 votes scanned 2026-10-18 00:06:55.117981

View on AUR

Why flagged

Downloads a prebuilt .deb from an AWS S3 bucket (beersmith3-2.s3.amazonaws.com) that is plausibly the vendor's own distribution infrastructure, with a pinned sha256 checksum; the binary is proprietary/unverifiable but the checksum and the official beersmith.com branding make silent swapping unlikely, so this is low risk rather than medium.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads a prebuilt .deb from an AWS S3 bucket (beersmith3-2.s3.amazonaws.com) that is plausibly the vendor's own distribution infrastructure, with a pinned sha256 checksum; the binary is proprietary/unverifiable but the checksum and the official beersmith.com branding make silent swapping unlikely, so this is low risk rather than medium.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source_x86_64=("https://beersmith3-2.s3.amazonaws.com/BeerSmith-${pkgver}_24_04_amd64.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Michaël Cadilhac <michael at cadilhac dot name>
    
      2# Contributor: Doug Newgard <scimmia at archlinux dot org>
    
      3
    
      4pkgname=beersmith3
    
      5pkgver=3.2.8
    
      6pkgrel=1
    
      7pkgdesc='Complete software suite for brewers (legacy version 3)'
    
      8arch=('x86_64')
    
      9url='https://beersmith.com'
    
      10license=('LicenseRef-scancode-commercial-license')
    
      11depends=('brotli' 'cairo' 'fontconfig' 'gdk-pixbuf2' 'glib2' 'glibc' 'gtk3'
    
      12         'hicolor-icon-theme'
    
      13         'libgcc' 'libjpeg-turbo' 'libnghttp2' 'libpng' 'libpsl' 'libsm'
    
      14         'libstdc++' 'libtiff' 'libx11' 'libxkbcommon' 'openssl' 'pango'
    
      15         'webkit2gtk-4.1' 'zlib' 'zstd')
    
      16# BeerSmith 4 uses separate executable, desktop entry, icons and data directories.
    
      17conflicts=('beersmith<4')
    
      18# Same upstream version as the last beersmith 3 package, rebuilt for current libraries.
    
      19source_x86_64=("https://beersmith3-2.s3.amazonaws.com/BeerSmith-${pkgver}_24_04_amd64.deb")
    
      20sha256sums_x86_64=('209f72df899f300295769f0f4575f8d88ca72915b7eeca8d6f79400b920f418d')
    
      21# Preserve the vendor executable; do not create an empty debug package.
    
      22options=('!strip' '!debug' '!emptydirs')
    
      23
    
      24package() {
    
      25  bsdtar --no-same-owner -xf data.tar.zst -C "$pkgdir"
    
      26
    
      27  rm -r "$pkgdir/etc" "$pkgdir/usr/share/menu"
    
      28  install -dm755 "$pkgdir/usr/share/licenses/$pkgname"
    
      29  ln -s ../../BeerSmith3/license.rtf "$pkgdir/usr/share/licenses/$pkgname/license.rtf"
    
      30}
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-18 00:06:55	Low	3
2026-10-17 23:21:47	Low	3
2026-10-17 23:20:05	Medium	3