caffviewer

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt JAR file directly from caff.de (the upstream project's own domain, matching the url= field) and installs it as an executable Java program. Two concerns: (1) All checksums are SKIP, meaning there is no integrity verification whatsoever — not even a hash to detect accidental or malicious tampering. (2) The JAR is a prebuilt binary executed at runtime via java -jar, so any compromise of the upstream host or a MITM would result in arbitrary code execution on the user's machine. The host caff.de appears to be the legitimate upstream vendor site for this viewer, so this is not an obviously unofficial/personal host, but the complete absence of checksums for an executed binary is a genuine supply-chain concern. This is a real medium-severity issue: executed binary from a host with no integrity verification, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("${pkgname}-${pkgver}.jar::https://caff.de/projects/caffviewer/caffviewer.jar"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt JAR file directly from caff.de (the upstream project's own domain, matching the url= field) and installs it as an executable Java program. Two concerns: (1) All checksums are SKIP, meaning there is no integrity verification whatsoever — not even a hash to detect accidental or malicious tampering. (2) The JAR is a prebuilt binary executed at runtime via java -jar, so any compromise of the upstream host or a MITM would result in arbitrary code execution on the user's machine. The host caff.de appears to be the legitimate upstream vendor site for this viewer, so this is not an obviously unofficial/personal host, but the complete absence of checksums for an executed binary is a genuine supply-chain concern. This is a real medium-severity issue: executed binary from a host with no integrity verification, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Dimitris Kiziridis <ragouel at outlook dot com>
    
      2
    
      3pkgname=caffviewer
    
      4pkgver=latest
    
      5pkgrel=1
    
      6pkgdesc="The de·caff Viewer version 3.x is a pure Java program for viewing AutoCAD® DWG, DXF and SHX files"
    
      7arch=('any')
    
      8url='https://caff.de/projects/caffviewer/'
    
      9license=('Apache' "custom:${pkgname}")
    
      10depends=('java-runtime>=8' 'bash')
    
      11makedepends=('gendesk')
    
      12noextract=("${pkgname}-${pkgver}.jar")
    
      13source=("${pkgname}-${pkgver}.jar::https://caff.de/projects/caffviewer/caffviewer.jar"
    
      14        'LICENSE'
    
      15        'caffviewer.png')
    
      16sha256sums=('SKIP'
    
      17            'SKIP'
    
      18            'SKIP')
    
      19
    
      20package() {
    
      21  install -Dm644 ${pkgname}-${pkgver}.jar -t "${pkgdir}/usr/share/java/${pkgname}"
    
      22  echo "#!/usr/bin/env bash
    
      23  exec /usr/bin/java -jar '/usr/share/java/${pkgname}/${pkgname}-${pkgver}.jar' "\$\@"" > caffviewer.sh
    
      24  install -Dm755 caffviewer.sh "${pkgdir}/usr/bin/caffviewer"
    
      25  install -Dm644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      26  gendesk -f -n --pkgname "${pkgname}" \
    
      27          --pkgdesc "$pkgdesc" \
    
      28          --name "de·caff Viewer" \
    
      29          --comment "$pkgdesc" \
    
      30          --exec "${pkgname}" \
    
      31          --categories 'Graphics;Application;' \
    
      32          --icon "${pkgname}"
    
      33  install -Dm644 "${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
      34  install -Dm644 caffviewer.png -t "${pkgdir}/usr/share/pixmaps"
    
      35}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2