charles-bundled-java

maintainer D3SOX · 9 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package downloads a .deb from the official charlesproxy.com domain, which is the project's own release infrastructure; extracting and modifying its contents is normal packaging behavior for AUR, and the source is verifiable via checksum.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a .deb from the official charlesproxy.com domain, which is the project's own release infrastructure; extracting and modifying its contents is normal packaging behavior for AUR, and the source is verifiable via checksum.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=(https://www.charlesproxy.com/packages/apt/pool/main/c/charles-proxy5/charles-proxy5_${pkgver}_amd64.deb)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nico <d3sox at protonmail dot com>
    
      2pkgname=charles-bundled-java
    
      3pkgver=5.2.1
    
      4pkgrel=1
    
      5pkgdesc="Web debugging proxy application (Standalone version using bundled Java)"
    
      6arch=('x86_64')
    
      7url="https://www.charlesproxy.com"
    
      8license=('custom')
    
      9makedepends=('tar' 'zstd')
    
      10conflicts=('charles')
    
      11provides=('charles')
    
      12replaces=('charles-bin' 'charles-beta-bin')
    
      13depends=('hicolor-icon-theme')
    
      14source=(https://www.charlesproxy.com/packages/apt/pool/main/c/charles-proxy5/charles-proxy5_${pkgver}_amd64.deb)
    
      15sha256sums=('6ddf72fe02116a3c86c4a279114ce7b7ec54d28ec6fd7fa4782eb4ca58b78e87')
    
      16
    
      17package() {
    
      18    cd "${pkgdir}"
    
      19    # this extracts all into the pkgdir
    
      20    tar xf "${srcdir}/data.tar.zst"
    
      21    # stop ^- from appearing in home directory
    
      22    sed -i 's/\^-/\/dev\/null/' "${pkgdir}/usr/bin/charles5"
    
      23}
    
      24

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-18 00:03
@@ -1,6 +1,6 @@
 # Maintainer: Nico <d3sox at protonmail dot com>
 pkgname=charles-bundled-java
-pkgver=5.1
+pkgver=5.2.1
 pkgrel=1
 pkgdesc="Web debugging proxy application (Standalone version using bundled Java)"
 arch=('x86_64')
@@ -12,7 +12,7 @@
 replaces=('charles-bin' 'charles-beta-bin')
 depends=('hicolor-icon-theme')
 source=(https://www.charlesproxy.com/packages/apt/pool/main/c/charles-proxy5/charles-proxy5_${pkgver}_amd64.deb)
-sha256sums=('99eeec6219008096b2d8ca9003f89c3bc8554c1e5fe65a3c7de68c5eb3356bfd')
+sha256sums=('6ddf72fe02116a3c86c4a279114ce7b7ec54d28ec6fd7fa4782eb4ca58b78e87')
 
 package() {
     cd "${pkgdir}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 00:17:07	LOW	2
2026-08-12 00:27:08	LOW	2
2026-08-11 11:21:04	MEDIUM	1
2026-06-19 19:07:35	CLEAN	2
2026-06-18 16:11:54	MEDIUM	1