boscaceoil

maintainer zapoutix · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt Windows executable from the official project domain boscaceoil.net; despite the non-whitelisted host, the source is legitimate and the package installs it via Wine, which is expected for such applications.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt Windows executable from the official project domain boscaceoil.net; despite the non-whitelisted host, the source is legitimate and the package installs it via Wine, which is expected for such applications.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("boscaceoil_win_v2.zip::http://www.boscaceoil.net/downloads/boscaceoil_win_v2.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mathieu ATTAL <mathieu.attal@gmail.com>
    
      2# Contributor: Mathieu ATTAL <mathieu.attal@gmail.com>
    
      3
    
      4# There is no source code available for the app itself.
    
      5# Repository https://github.com/TerryCavanagh/boscaceoil/
    
      6
    
      7pkgname=boscaceoil
    
      8
    
      9_pkgver_tag='2.0' # Git tag associated with the release where the latest archive is.
    
      10_pkgver_suffix='.0' # Anything after $_pkgver_tag that is present in the archive name.
    
      11_pkgver_upstream="$_pkgver_tag$_pkgver_suffix"
    
      12
    
      13pkgver="$_pkgver_upstream"
    
      14
    
      15pkgrel=1
    
      16
    
      17pkgdesc='Bosca Ceoil is a free, easy to use tool for creating music!'
    
      18arch=('x86_64')
    
      19url="https://boscaceoil.net/"
    
      20source=("boscaceoil_win_v2.zip::http://www.boscaceoil.net/downloads/boscaceoil_win_v2.zip"
    
      21        'boscaceoil'
    
      22        'boscaceoil.desktop'
    
      23        'LICENSE')
    
      24license=('custom')
    
      25depends=(wine lib32-alsa-plugins lib32-libpulse lib32-openal)
    
      26makedepends=(icoutils)
    
      27sha512sums=('73fa4bd00b85920197221ba0fb1dfc5412c98d6a7a6eebe8e4c46289a2846edfaede0feadd5e7b020c09b716206ca641e33b465c9968c4cbb6eb998b93593cc2'
    
      28            '6004c38f7d95b084aaad6d66c59a0b9056dc500d8e11db315b6cf6b8fae6ea56e84c38ef59528961ca156d8d7a99de1a55c3c0f2b0f40752e5997c8dd141f11b'
    
      29            '504c4c050e86639d839d809b2b4d84fe4f4e4cee38bd1c2c1bea275902c8440cd1b0cb994090d9a72980887e14e006b95596260fffda03945de0acae16a91891'
    
      30            '06cf0662a4ac8bc8fe8b4cae13a244d03536239fec9839b5b67f64aeda8e3268e7d01d65acf401a45ba8415da31c6acc9c8d9bc725390f8ab640242a5253d5c8')
    
      31
    
      32build() {
    
      33  wrestool -x --output=boscaceoil.ico -t14 "BoscaCeoil.exe"
    
      34  icotool -x boscaceoil.ico -o boscaceoil.png
    
      35}
    
      36
    
      37package() {
    
      38  install -dm755 "$pkgdir/usr/share/boscaceoil"
    
      39  cp -ra "." "$pkgdir/usr/share/boscaceoil"
    
      40  rm -rf "$pkgdir/usr/share/boscaceoil/boscaceoil_win_v2.zip"
    
      41
    
      42  install -Dm755 boscaceoil "$pkgdir/usr/bin/boscaceoil"
    
      43
    
      44  install -dm755 "$pkgdir/usr/share/applications"
    
      45  install -m644 boscaceoil.desktop "$pkgdir/usr/share/applications/boscaceoil.desktop"
    
      46
    
      47  install -dm755 "$pkgdir/usr/share/icons/hicolor/256x256/apps"
    
      48  install -m644 boscaceoil.png "$pkgdir/usr/share/icons/hicolor/256x256/apps/boscaceoil.png"
    
      49
    
      50  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2