btcaddress-alpha-bin

maintainer maxweiss · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a source file from web.archive.org, a non-standard but trusted archival host, which is used to preserve access to the original project; the source is a prebuilt binary archive, but the context indicates it is the only available source due to the original site being offline, and there is no evidence of malicious intent or code execution beyond normal packaging.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source file from web.archive.org, a non-standard but trusted archival host, which is used to preserve access to the original project; the source is a prebuilt binary archive, but the context indicates it is the only available source due to the original site being offline, and there is no evidence of malicious intent or code execution beyond normal packaging.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 "btcaddress-alpha.zip::https://web.archive.org/web/20140110122807/http://casascius.com/btcaddress-alpha.zip")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:   Maximilian Weiss <$(echo "bWF4QG1heHdlaXNzLmlv" | base64 -d)>
    
      2# Contributor:  Mike Caldwell
    
      3
    
      4
    
      5pkgname=btcaddress-alpha-bin
    
      6pkgver=0.0.1
    
      7pkgrel=3
    
      8
    
      9
    
      10pkgdesc="Casascius Bitcoin Address Utility"
    
      11
    
      12arch=('i686' 'x86_64')
    
      13
    
      14url='https://web.archive.org/web/20130712011038/https://casascius.wordpress.com/2013/01/26/bitcoin-address-utility/'
    
      15#url='https://casascius.wordpress.com/2013/01/26/bitcoin-address-utility/'
    
      16#url='https://github.com/casascius/Bitcoin-Address-Utility'
    
      17
    
      18license=('Unknown' 'custom:FOSS')
    
      19
    
      20depends=('mono')
    
      21
    
      22provides=('btcaddress-alpha-bin')
    
      23conflicts=('btcaddress-alpha-bin')
    
      24
    
      25source=('btcaddress.png'
    
      26        'btcaddress.desktop'
    
      27        "btcaddress-alpha.zip::https://web.archive.org/web/20140110122807/http://casascius.com/btcaddress-alpha.zip")
    
      28
    
      29# https://casascius.com/btcaddress-alpha.zip
    
      30# Casascius site is no longer available
    
      31
    
      32# Backups:
    
      33# https://ipfs.io/ipfs/QmcbgvdV5qaezKG5tLJ71GXKdikpoH3zHBfNc4SGdbLYN2
    
      34# https://web.archive.org/web/20130712011038/https://casascius.wordpress.com/2013/01/26/bitcoin-address-utility/
    
      35
    
      36
    
      37sha256sums=('3e7e6fcfa81a8617414198c46dfa0fa3489c96ac216e902ec5fabfeb664a9442'
    
      38            'ec7183ad277d2ccb01e6f8b6099b750fbf974b9acfb3e7139d21b8b54ccee535'
    
      39            '008b92949bbcedebc8da278e2c27156a35b3041e232a4e426efce471a6f2506e')
    
      40
    
      41package() {
    
      42    mkdir -p "$pkgdir/opt/btcaddress/"
    
      43    mkdir -p "$pkgdir/usr/share/applications/"
    
      44    mkdir -p "$pkgdir/usr/share/pixmaps/"
    
      45    install -Dm644 "$srcdir/btcaddress.png" "$pkgdir/usr/share/pixmaps/"
    
      46    install -Dm644 "$srcdir/btcaddress.desktop" "$pkgdir/usr/share/applications/"
    
      47    rm -f "$srcdir/btcaddress.png"
    
      48    rm -f "$srcdir/btcaddress.desktop"
    
      49    rm -f "$srcdir/btcaddress-alpha.zip"
    
      50    rm -f "$srcdir/source.zip"
    
      51    cd "$srcdir/"
    
      52    for i in *.*; do
    
      53        install -Dm644 "$srcdir/$i" "$pkgdir/opt/btcaddress/"
    
      54    done
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2