bouml

maintainer yngvelevin · 80 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads prebuilt RPM binaries (containing executables and libraries) from bouml.fr, which is the official upstream website for the BOUML UML tool. This is not a random personal host — it is the project's own domain matching the `url` field. However, the binaries are precompiled RPMs for CentOS 6/7 being repackaged for Arch Linux without any build step, meaning users execute binaries that cannot be audited from source. The sha256sums also appear malformed for i686 (the checksum line includes the filename inline, which is not valid PKGBUILD syntax and would likely cause makepkg to fail verification). While bouml.fr is the legitimate upstream, distributing prebuilt closed binaries from any host — even the official one — without source compilation is a genuine supply-chain concern since there is no way to verify the binary matches the GPL source. This is a real medium-risk pattern (executed binary from a non-Arch-official host, no source build), though not clearly malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source_x86_64=("v${pkgver}-64.tar.gz::https://www.bouml.fr/files/$pkgname-${pkgver%\.0}-CentOS7.x86_64.rpm")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads prebuilt RPM binaries (containing executables and libraries) from bouml.fr, which is the official upstream website for the BOUML UML tool. This is not a random personal host — it is the project's own domain matching the `url` field. However, the binaries are precompiled RPMs for CentOS 6/7 being repackaged for Arch Linux without any build step, meaning users execute binaries that cannot be audited from source. The sha256sums also appear malformed for i686 (the checksum line includes the filename inline, which is not valid PKGBUILD syntax and would likely cause makepkg to fail verification). While bouml.fr is the legitimate upstream, distributing prebuilt closed binaries from any host — even the official one — without source compilation is a genuine supply-chain concern since there is no way to verify the binary matches the GPL source. This is a real medium-risk pattern (executed binary from a non-Arch-official host, no source build), though not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1#!/bin/bash
    
      2# Maintainer: Stick <stick@stma.is>
    
      3# Contributor: Nissar Chababy <funilrys@outlook.com>
    
      4# Contributor: Jorge Barroso <jorge.barroso.11@gmail.com>
    
      5# Contributor: cros_145<joner14@hotmail.com>
    
      6# shellcheck disable=SC2034,SC2154
    
      7
    
      8pkgname=bouml
    
      9pkgver=7.11.0
    
      10pkgrel=1
    
      11pkgdesc='A free UML 2 tool box including a modeler allowing you to specify and generate code in C++, Java, IDL, PHP, Python, and MySQL'
    
      12arch=('i686' 'x86_64')
    
      13url='https://bouml.fr/'
    
      14license=('GPL')
    
      15depends=('qt4')
    
      16source_x86_64=("v${pkgver}-64.tar.gz::https://www.bouml.fr/files/$pkgname-${pkgver%\.0}-CentOS7.x86_64.rpm")
    
      17source_i686=("v${pkgver}-32.tar.gz::https://www.bouml.fr/files/$pkgname-${pkgver%\.0}-CentOS6.i686.rpm")
    
      18sha256sums_x86_64=('2ade4ec5a68b4dabfb1933e264ae5f183599aa3170c4274ddf2edb863236c57b')
    
      19sha256sums_i686=('f4c06e53e216fff499523d529a02b5900d7501adb17aa2b173090bea5b4063cf  bouml-7.11-CentOS6.i686.rpm')
    
      20
    
      21package() {
    
      22	mkdir -p "$pkgdir"/usr/bin/
    
      23	mkdir -p "$pkgdir"/usr/share/applications/
    
      24	mkdir -p "$pkgdir"/usr/share/icons
    
      25	cp -R "$srcdir"/usr/bin/* "$pkgdir"/usr/bin/
    
      26	cp -R "$srcdir"/usr/share/applications/* "$pkgdir"/usr/share/applications/
    
      27	cp -R "$srcdir"/usr/share/icons/* "$pkgdir"/usr/share/icons/
    
      28	mkdir -p "$pkgdir"/usr/lib/bouml
    
      29	if [ "$CARCH" = "x86_64" ]; then
    
      30		cp -R "$srcdir"/usr/lib64/bouml/* "$pkgdir"/usr/lib/bouml/
    
      31	else
    
      32		cp -R "$srcdir"/usr/lib/bouml/* "$pkgdir"/usr/lib/bouml/
    
      33	fi
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2