chdk-stick-bin

maintainer dreieck · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads source files, including a JAR and HTML documentation, from the project's official host (zenoshrdlu.com), which is plausibly the maintainer's site; the JAR is part of the official project distribution and not an obfuscated or unverifiable binary, and the host, while not a major platform, is project-specific and consistent with the software's provenance.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source files, including a JAR and HTML documentation, from the project's official host (zenoshrdlu.com), which is plausibly the maintainer's site; the JAR is part of the official project distribution and not an obfuscated or unverifiable binary, and the host, while not a major platform, is project-specific and consistent with the software's provenance.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:38 "stick_${pkgver}.zip::http://www.zenoshrdlu.com/stick/stick.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: dreieck
    
      2
    
      3_pkgname="chdk-stick"
    
      4pkgname="${_pkgname}-bin"
    
      5pkgver=1.12_2020
    
      6pkgrel=1
    
      7epoch=0
    
      8pkgdesc="Application designed to make the process of installing CHDK on your Canon camera as simple as possible."
    
      9arch=(
    
      10  any
    
      11)
    
      12url="http://www.zenoshrdlu.com/stick/stick.html"
    
      13license=(
    
      14  'custom: freeware'
    
      15)
    
      16groups=(
    
      17  'chdk'
    
      18)
    
      19depends=(
    
      20  'bash'
    
      21  'java-runtime'
    
      22)
    
      23makedepends=()
    
      24checkdepends=()
    
      25optdepends=()
    
      26provides=(
    
      27  "${_pkgname}=${pkgver}"
    
      28)
    
      29conflicts=(
    
      30  "${_pkgname}"
    
      31)
    
      32replaces=()
    
      33backup=()
    
      34options=()
    
      35install=
    
      36changelog=
    
      37source=(
    
      38  "stick_${pkgver}.zip::http://www.zenoshrdlu.com/stick/stick.zip"
    
      39  "http://www.zenoshrdlu.com/stick/stick.html"
    
      40  "http://www.zenoshrdlu.com/stick/stick0.html"
    
      41  "http://www.zenoshrdlu.com/stick/stick1.html"
    
      42  "http://www.zenoshrdlu.com/stick/stick11.html"
    
      43  "http://www.zenoshrdlu.com/stick/stick111.html"
    
      44  "http://www.zenoshrdlu.com/stick/stick2.html"
    
      45  "http://www.zenoshrdlu.com/stick/stick3.html"
    
      46  "http://www.zenoshrdlu.com/stick/stick33.html"
    
      47  "http://www.zenoshrdlu.com/stick/stick4.html"
    
      48  "http://www.zenoshrdlu.com/stick/stick40.html"
    
      49  "http://www.zenoshrdlu.com/stick/stick41.html"
    
      50  "http://www.zenoshrdlu.com/stick/stick5.html"
    
      51  "http://www.zenoshrdlu.com/stick/stick6.html"
    
      52  "http://www.zenoshrdlu.com/stick/stick7.html"
    
      53  "http://www.zenoshrdlu.com/stick/stick8.html"
    
      54  "http://www.zenoshrdlu.com/stick/stickx.html"
    
      55  "run-stick.sh"
    
      56  "license-info.txt"
    
      57)
    
      58noextract=()
    
      59sha256sums=(
    
      60  '50873c97f1cf4645b13abfb0660c96490deab67f56c106207bf7a7055a003f67'
    
      61  '5c7c275d3e75da043e7902e2cb2ce57144f9eff8ab09f3880f40b547b0782e34'
    
      62  'c44475922a8057f982e09dac5f98660b680c224572cfc10b24183e335d05a3f7'
    
      63  '706046f2800ec3e0cc629851944634b2807fcde94d4cdafdcf0383b843fc56cb'
    
      64  'ce2d44aa5b4d8705f55da7f84ae0de7ff2541f436b5887cc952a4e2611373f0e'
    
      65  'b09a39bde1b83ee9cdcb1d59e4e0d566cc07e64452c2fee9dcc39a439b7fcca7'
    
      66  '9d0cd1a50fdcf0f892a70499afbde46b7590afb79d93cece3e60d3bfe3e4ddb8'
    
      67  '53e03d602a587455c618564d7dbce2699d72827e1321e66cd031f6306cd6beff'
    
      68  'c88c053417e7c32b34220bd7e982b18b80cee6ac8c3b2e3c979ca0d9fe8dc521'
    
      69  '6115aa07d646aade52ae7c2ce30a5ca994e1a3f737c3e5c7c9553c5295c3b08f'
    
      70  '5b0dfa2bf1bddae17557e2aa02da883ed751d03cd754a6c247cf7b66824a287e'
    
      71  '421dc6726cd0585f7f0c4ccf4d378afec190fb738a360d56864587d90201ef26'
    
      72  '27af872ad4d2d90ebd8b32f94d15f2c5a0ecd6343b5998c584ce5321a391d4b9'
    
      73  'b5afa761fc9ad1527d6bb406ce6754a6a519ba02ea8ef7bad13a404953228651'
    
      74  '1815c709fc38071de3c4943da88c9b26aa3ece46f1568a0cdb224fc0f0f9a115'
    
      75  '78f542b94c694b5057074076d1c29d2768c2bf1d20ae340c5d0eeb1066f8bdc4'
    
      76  'e5ea8c9f9182a2f477e3c6b8640e0d8d143cb46e8e2d0283c09334ab129358fb'
    
      77  '755235bdedc1ec28fa2127769efc2a96d7c2499a3a4dd4966fe3cc89b9221c27'
    
      78  '2a7c6ad8d5be58f87a9068a92f1e00bf70351d6f9ca5fc314beacf11de8b8107'
    
      79)
    
      80validpgpkeys=()
    
      81
    
      82prepare() {
    
      83  printf '%s\n' "${url}" > "${srcdir}/website.url"
    
      84}
    
      85
    
      86package() {
    
      87  install -v -m644 -D "${srcdir}/stick/stick.jar"     "${pkgdir}/usr/lib/stick/stick.jar"
    
      88  install -v -m755 -D "${srcdir}/run-stick.sh"        "${pkgdir}/usr/bin/stick"
    
      89
    
      90  for _htmlfilesuffix in '' 0 1 11 111 2 3 33 4 40 41 5 6 7 8 x; do
    
      91    install -v -m644 -D "${srcdir}/stick${_htmlfilesuffix}.html"         "${pkgdir}/usr/share/doc/${_pkgname}/stick${_htmlfilesuffix}.html"
    
      92  done
    
      93  install -v -m644 -D "${srcdir}/website.url"         "${pkgdir}/usr/share/doc/${_pkgname}/website.url"
    
      94  install -v -m644 -D "${srcdir}/license-info.txt"    "${pkgdir}/usr/share/licenses/${pkgname}/COPYING-info.txt"
    
      95  cd "${pkgdir}/usr/share/doc/${_pkgname}"
    
      96  ln -sfv "/usr/share/licenses/${pkgname}/COPYING-info.txt"     'COPYING-info.txt'
    
      97}
    
      98

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2