cge7-bin

LOW

maintainer Sterophonick 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt Windows executable (CGE7.exe) and supporting data files from the project's official but non-whitelisted domain; the worst case of a malicious swap is limited to running untrusted code via Wine, but the source is plausibly the original project's host, and no obfuscated or executable scripts are run during install.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt Windows executable (CGE7.exe) and supporting data files from the project's official but non-whitelisted domain; the worst case of a malicious swap is limited to running untrusted code via Wine, but the source is plausibly the original project's host, and no obfuscated or executable scripts are run during install.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=(http://www.maroon.dti.ne.jp/youkan/mz700/CGE7.zip

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sterophonick
    
      2
    
      3pkgname=cge7-bin
    
      4pkgver=0.24
    
      5pkgrel=1
    
      6pkgdesc='MZ-700 Character Graphics Editor'
    
      7url='http://www.maroon.dti.ne.jp/youkan/mz700/index.html'
    
      8arch=(x86_64 i686)
    
      9depends=('wine' 'winetricks')
    
      10source=(http://www.maroon.dti.ne.jp/youkan/mz700/CGE7.zip
    
      11        mz700fon.dat
    
      12        cge7
    
      13        cge7.desktop
    
      14        cge7.png)
    
      15md5sums=('8f723fb0837d9f74a5e21bfbff8ea7b9'
    
      16         '5d4fa8ac653e0fa7a28bd10d2180bdc8'
    
      17         'SKIP'
    
      18         'SKIP'
    
      19         'SKIP')
    
      20
    
      21
    
      22package() {
    
      23  cd $srcdir
    
      24  install -Dm755 cge7 $pkgdir/usr/bin/cge7
    
      25  install -Dm644 cge7.desktop $pkgdir/usr/share/applications/cge7.desktop
    
      26  install -Dm644 cge7.png $pkgdir/usr/share/pixmaps/cge7.png
    
      27  
    
      28  mkdir -p $pkgdir/usr/share/cge7
    
      29
    
      30  install -Dm644 CGE7.exe $pkgdir/usr/share/cge7/CGE7.exe
    
      31  install -Dm644 readme.txt $pkgdir/usr/share/cge7/readme.txt
    
      32  install -Dm644 mz700fon.dat $pkgdir/usr/share/cge7/mz700fon.dat
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2