codelite-bin

LOW

maintainer Dominiquini 34 votes scanned 2026-09-22 00:15:14.502938

View on AUR

Why flagged

The package downloads a prebuilt .deb from the official project's download domain; while the host is not a standard forge, it is plausibly codelite.org's own infrastructure, and the binary is unpacked without further remote execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from the official project's download domain; while the host is not a standard forge, it is plausibly codelite.org's own infrastructure, and the binary is unpacked without further remote execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 source_x86_64=("https://downloads.codelite.org/codelite/${pkgver}/CodeLite-${pkgver}-gtk3-${_pkgubuntu}-x86_64.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      2# Contributor: Fabio 'Lolix' Loli <fabio.loli@disroot.org>
    
      3# Contributor: Antoine Viallon <antoine.viallon@gmail.com>
    
      4# Contributor: agvares <omen13@bk.ru>
    
      5# Contributor: Zeph <zeph33@gmail.com>
    
      6
    
      7pkgname=codelite-bin
    
      8pkgver=18.4.0
    
      9pkgrel=1
    
      10_pkgubuntu="ubuntu-noble"
    
      11pkgdesc="A cross platform C/C++/PHP and Node.js IDE written in C++"
    
      12arch=(x86_64)
    
      13url="https://codelite.org/"
    
      14license=(GPL-2.0)
    
      15depends=(gcc-libs glibc bash python php openssl fontconfig libtiff zlib libwebp gtk3 wayland expat cairo hunspell pango libglvnd libjpeg-turbo sqlite libxkbcommon hicolor-icon-theme pcre2 libx11 libxtst glib2 libpng libsm libssh gdk-pixbuf2)
    
      16optdepends=( 'graphviz: callgraph visualization'
    
      17             'gcc: compiler'
    
      18             'gdb: debugger'
    
      19             'valgrind: debugger'
    
      20             'php: php IDE capabilities'
    
      21             'nodejs: for Node.js IDE'
    
      22            )
    
      23provides=(codelite)
    
      24conflicts=(codelite)
    
      25
    
      26source_x86_64=("https://downloads.codelite.org/codelite/${pkgver}/CodeLite-${pkgver}-gtk3-${_pkgubuntu}-x86_64.deb")
    
      27sha256sums_x86_64=('73e136df463eff19f73ccedad10c4d9b810d91c234fd1ebca66cf34a33899a9b')
    
      28
    
      29package() {
    
      30    bsdtar -xf ${srcdir}/data.tar.gz -C ${pkgdir}/
    
      31
    
      32    echo "NoDisplay=true" >> ${pkgdir}/usr/share/applications/codelite-url-handler.desktop
    
      33    echo "StartupNotify=true" >> ${pkgdir}/usr/share/applications/codelite-url-handler.desktop
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-22 00:15:14	Low	2
2026-09-21 23:36:21	Medium	1
2026-06-19 19:07:35	Clean	2
2026-06-18 18:04:49	Clean	2
2026-06-18 16:11:54	Medium	1