calcesara

LOW
maintainer sigurd4 1 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The package downloads a prebuilt installer from the official project host (web.calce.umd.edu), which is plausibly the project's own; building from this source is normal for AUR packages and the installer is unpacked, not executed remotely.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt installer from the official project host (web.calce.umd.edu), which is plausibly the project's own; building from this source is normal for AUR packages and the installer is unpacked, not executed remotely.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:71 "https://web.calce.umd.edu/software/releaseSARA/${pkgver}/${_installer_exe}"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: sigurd4 <sigurd dot spangelo at gmail dot com>
2# Authors: Prof. Michael Pecht, Dr. Michael Osterman
3# Contributors: Prof. Abhijit Dasgutpa, Prof. Donald Barker, David Eisner
4#
5# ##############################################################################################
6#
7# Thank you for your interest in the calceSARA Software.
8#
9# Copyright:
10# Copyright (c) 1987,2020 CALCE and the University of Maryland
11# All Rights Reserved
12#
13# License:
14# Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
15#
16#The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
17# Liability:
18#
19# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
20# Contact:
21#
22# CALCE, University of Maryland, College Park, MD 20742
23# calce-software@umd.edu
24
25# Package name without suffix (-git, -bin, -whatever)
26_pkgname=calcesara
27
28DLAGENTS=('https::/usr/bin/curl -k -o %o %u')
29pkgname="${_pkgname}"
30pkgver=8.6.6
31pkgrel=1
32pkgdesc='Simulation Assisted Reliability Assessment (SARA) Software'
33arch=('any')
34url='https://web.calce.umd.edu/software/releaseSARA'
35license=('LicenseRef-calceSARA')
36depends=(
37 'wine' # Runs CalceSARA
38 'wine-mono' # .NET framework
39 'bash' # Runs launch script
40 'sed' # Templating
41 'coreutils' # tail and printf are used in launch script for keygen
42)
43optdepends=(
44 'winetricks: Installs microsoft fonts locally if missing from system'
45 'ttf-ms-win10-auto: Microsoft fonts'
46 'ttf-liberation: Serif and sans-serif fonts'
47 'ttf-dejavu: Serif and sans-serif fonts'
48)
49makedepends=(
50 'curl' # Downloads sources
51 'imagemagick' # Convert icons to png
52 'gendesk' # Generate desktop entries
53 '7zip' # Unzip installer binary
54)
55
56# Keyfile-name
57_keyfile_name='calce.key'
58
59# Keygen template
60_keygen_template="${_keyfile_name}.template"
61
62# Install location folder name.
63_exe_name="calceSARAv${pkgver}"
64
65# Installer filename.
66_installer_exe="install_${_exe_name}.exe"
67
68source=(
69 "${_keyfile_name}.template"
70 "${_pkgname}.sh.template"
71 "https://web.calce.umd.edu/software/releaseSARA/${pkgver}/${_installer_exe}"
72)
73sha256sums=(
74 826670642a9eba219d64063510a8ca33da4a8f2b53717e22c80796bf877e0885
75 f64901f5f5df3bf613b1bf143602380a52469c2a36723b7c5ff6ea95260bca1b
76 5b4cabdc9942978a4473802e2a999a870c911080d3f8b1f365b727631097fd97
77)
78
79# If you don't have these font, most text will just render as boxes.
80# Fonts that are missing from your system will be installed locally in the wine-bottle by winetricks if you have winetricks installed.
81# See optdepends for relevant packages
82_fonts=(
83 'arial' # Most important one. Provided by msfonts
84 'arialbd=arial' # Most important one. Provided by msfonts
85 'ariali=arial' # Most important one. Provided by msfonts
86 'arialbi=arial' # Most important one. Provided by msfonts
87
88 'times' # Provided by msfonts
89 'timesbd=times' # Provided by msfonts
90 'timesi=times' # Provided by msfonts
91 'timesbi=times' # Provided by msfonts
92
93 'tahoma' # Provided by msfonts
94 'tahomabd=tahoma' # Provided by msfonts
95
96 'DejaVuSerif|LiberationSerif-Regular=liberation' # Provided by ttf-dejavu or ttf-liberation
97 'DejaVuSerif-Bold|LiberationSerif-Bold=liberation' # Provided by ttf-dejavu or ttf-liberation
98 'DejaVuSerif-Italic|LiberationSerif-Italic=liberation' # Provided by ttf-dejavu or ttf-liberation
99 'DejaVuSerif-BoldItalic|LiberationSerif-BoldItalic=liberation' # Provided by ttf-dejavu or ttf-liberation
100
101 'DejaVuSans|LiberationSans-Regular=liberation' # Provided by ttf-dejavu or ttf-liberation
102 'DejaVuSans-Bold|LiberationSans-Bold=liberation' # Provided by ttf-dejavu or ttf-liberation
103 'DejaVuSans-Oblique|LiberationSans-Italic=liberation' # Provided by ttf-dejavu or ttf-liberation
104 'DejaVuSans-BoldOblique|LiberationSans-BoldItalic=liberation' # Provided by ttf-dejavu or ttf-liberation
105
106 'DejaVuSansMono|LiberationMono-Regular=liberation' # Provided by ttf-dejavu or ttf-liberation
107 'DejaVuSansMono-Bold|LiberationMono-Bold=liberation' # Provided by ttf-dejavu or ttf-liberation
108 'DejaVuSansMono-Oblique|LiberationMono-Italic=liberation' # Provided by ttf-dejavu or ttf-liberation
109 'DejaVuSansMono-BoldOblique|LiberationMono-BoldItalic=liberation' # Provided by ttf-dejavu or ttf-liberation
110)
111
112# Found in DecryptInputStream and EncryptOutputStream in calce source code.
113# Required for keygens because CALCE's official keys are unreliable when running CalceSARA under wine.
114_keygen_cryptkey=0xD4
115
116# Runner CLI options.
117# Each option corresponds to a different CalceSARA application.
118_options=(
119 'fast'
120 'tce|tcextractor'
121 'docs'
122 'pwa'
123 'wr|whiskerrisk'
124 'updates'
125)
126
127# Shortcut names of start-menu entries.
128# These are needed to launch the different applcations.
129# Each program is launched from its start-menu shortcut, so these are important.
130_lnks=(
131 'calceFAST'
132 'calceTCExtractor'
133 'User Documentation'
134 'calcePWA'
135 'calceWhiskerRisk'
136 'Updates'
137)
138
139# Shared application data will be stored in /opt
140# I think that's ok.
141_shared_data_prefix='/opt'
142_shared_data_location=${_shared_data_prefix}/${_pkgname}
143
144prepare() {
145 cd "${srcdir}"
146
147 # Text replacement on launcher template
148 local __option_cases=""
149 local __options_help_list=""
150 for i in ${!_lnks[@]}; do
151 local __option="${_options[i]}"
152 local __lnk="${_lnks[i]}"
153 __option_cases="${__option_cases}\n\t${__option}) lnk=${__lnk};;"
154 __option_help_list="${__option_help_list}\\n\\t- ${__option}"
155 done
156 local __fonts=""
157 for i in ${_fonts[@]}; do
158 __fonts+="\n\t\'${i}\'"
159 done
160 sed -i "s/@keygen_cryptkey@/${_keygen_cryptkey}/g" "${_pkgname}.sh.template"
161 sed -i "s/@pkgver@/${pkgver}/g" "${_pkgname}.sh.template"
162 sed -i "s/@pkgname@/${_pkgname}/g" "${_pkgname}.sh.template"
163 sed -i "s/@exe_name@/${_exe_name}/g" "${_pkgname}.sh.template"
164 sed -i "s/@keyfile_name@/${_keyfile_name}/g" "${_pkgname}.sh.template"
165 sed -i "s#@shared_data_prefix@#${_shared_data_prefix}#g" "${_pkgname}.sh.template"
166 sed -i "s/@option_help_list@/${__option_help_list}/g" "${_pkgname}.sh.template"
167 sed -i "s/@option_cases@/${__option_cases}/g" "${_pkgname}.sh.template"
168 sed -i "s/@fonts@/${__fonts}/g" "${_pkgname}.sh.template"
169
170 cp "${_pkgname}.sh.template" "${_pkgname}.sh"
171 sed -i "s/#@check@/# Good to go!/g" "${_pkgname}.sh.template"
172 sed -i "s/#@check@/exit 0/g" "${_pkgname}.sh"
173
174 # Extracts installer to obtain icon files for desktop entries.
175 7z e "${_installer_exe}" -y
176}
177
178# Desktop entry metadata
179_desk_names=(
180 'calceFAST'
181 'calceTCExtractor'
182 'calceSARA User Documentation'
183 'calcePWA'
184 'calceWhiskerRisk'
185 'calceSARA Updates'
186)
187
188build() {
189 cd "${srcdir}"
190
191 local _desk_generic_names=(
192 'Failure Assessment Toolkit'
193 'Temperature Cycle Extraction Module'
194 'User Documentation'
195 'Physical Wiring Assembly Toolbox'
196 'Whisker Risk Calculator'
197 'Updater'
198 )
199 local _desk_comments=(
200 'Failure Assessment Toolkit'
201 'Temperature Cycle Extraction Module'
202 'Documentation for calceSARA'
203 'Physical Wiring Assembly Toolbox'
204 'Whisker Risk Calculator'
205 'Update and validate calceSARA'
206 )
207
208 # Generate desktop entries
209 for i in ${!_lnks[@]}; do
210 local __lnk="${_lnks[i]}"
211 local __desk_name="${_desk_names[i]}"
212 local __desk_generic_name="${_desk_generic_names[i]}"
213 local __desk_comment="${_desk_comments[i]}"
214 local __option="$(echo ${_options[i]} | sed 's/|.*//g')" # Strip aliases
215
216 # Convert icon to png
217 magick "${__lnk}.ico" "${__desk_name}.png"
218 rm "${__lnk}.ico"
219
220 # Generate desktop entry
221 gendesk --pkgname "${_pkgname}" --pkgdesc "${__pkgdesc}" -n --name="${__desk_name}" --genericname="${__desk_generic_name}" --comment="${__desk_comment}" --icon="${__desk_name}" --terminal=false --exec="/usr/bin/${_pkgname} ${__option}" -f
222 mv "${_pkgname}.desktop" "${_pkgname}-${__lnk}.desktop"
223 done
224}
225
226check()
227{
228 cd "${srcdir}"
229
230 bash "${srcdir}/${_pkgname}.sh"
231}
232
233package()
234{
235 cd "${srcdir}"
236
237 # Install License
238 install -Dm644 "${srcdir}/calcelicense.txt" "${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE"
239
240 # Install Desktop files
241 for i in ${!_lnks[@]}; do
242 local __lnk="${_lnks[i]}"
243 local __desk_name="${_desk_names[i]}"
244
245 install -Dm644 "${srcdir}/${__desk_name}.png" "${pkgdir}/usr/share/pixmaps/${__desk_name}.png"
246 install -Dm644 "${srcdir}/${_pkgname}-${__lnk}.desktop" "${pkgdir}/usr/share/applications/${_pkgname}-${__lnk}.desktop"
247 done
248
249 # Docs are in the wine-bottle. (for now... not ideal)
250 # Install docs to /usr/share/doc/
251 #install -m755 -d "${pkgdir}/usr/share/doc/${_pkgname}"
252 #cp -r calceSARAHelp/* "${pkgdir}/usr/share/doc/${_pkgname}"
253
254 # Install shared files to /opt/
255 install -Dm755 -d "${pkgdir}${_shared_data_location}"
256 install -Dm644 "${srcdir}/${_keygen_template}" "${pkgdir}${_shared_data_location}/${_keyfile_name}.template"
257 install -Dm644 "${srcdir}/${_installer_exe}" "${pkgdir}${_shared_data_location}/install_${_exe_name}.exe"
258
259 # N/A
260 #install -m644 ChangeLog.txt "${pkgdir}/opt/${_pkgname}"
261
262 # symlink help files
263 #ln -sv "/usr/share/doc/${_pkgname}" "${pkgdir}/opt/${_pkgname}/calceSARAHelp"
264
265 # Install launch script
266 install -Dm755 "${srcdir}/${_pkgname}.sh.template" "${pkgdir}/usr/bin/${_pkgname}"
267}
268
269

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion