context-lmtx-bin
LOW
maintainer adityam
1 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a source archive from a non-whitelisted but project-associated host (lmtx.pragma-ade.nl) used by the official ConTeXt project; the source is a build artifact but not an obfuscated or untrusted executable, and the build process uses standard project tooling to update and install components.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source archive from a non-whitelisted but project-associated host (lmtx.pragma-ade.nl) used by the official ConTeXt project; the source is a build artifact but not an obfuscated or untrusted executable, and the build process uses standard project tooling to update and install components.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:37
source=("https://${_lmtxserver}/install-lmtx/${_zipfile}")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Aditya Mahajan <adityam at umich dot edu>
2
3
pkgname=context-lmtx-bin
4
pkgver=2025.08.17
5
pkgrel=1
6
pkgdesc="ConTeXt LuaMetaTeX distribution"
7
url="http://www.contextgarden.net"
8
license=('GPL')
9
arch=('i686' 'x86_64')
10
optdepends=('ghostscript: support for PS and EPS images'
11
'graphicsmagick: support for GIF and TIFF images'
12
'inkscape: support for SVG images'
13
'pstoedit: support for metapost outlines for fonts'
14
'zint: support for barcodes'
15
'curl: loading remote content')
16
17
makedepends=('rsync' 'curl')
18
conflicts=()
19
replaces=()
20
backup=()
21
22
install=context-lmtx-bin.install
23
options=(!strip)
24
25
# ConTeXt minimals uses a different naming convention for architectures
26
27
declare -A _platform_map
28
29
_platform_map['i686']='linux-32'
30
_platform_map['x86_64']='linux-64'
31
_platform=${_platform_map[$CARCH]}
32
33
_lmtxserver=lmtx.pragma-ade.nl
34
_lmtxserverlist=lmtx.contextgarden.net,lmtx.pragma-ade.com,lmtx.pragma-ade.nl
35
_zipfile=context-${_platform}.zip
36
37
source=("https://${_lmtxserver}/install-lmtx/${_zipfile}")
38
md5sums=('SKIP')
39
40
# List of _modules to be installed
41
# Can use '--all' to install all modules
42
_modules=('filter' 'visualcounter' 'vim' 'tikz' 'typescripts')
43
44
_dest=/opt/context-lmtx
45
46
# Font directories
47
_texlivefontdir="/usr/share/texmf-dist/fonts/"
48
_userfontdir="\$HOME/.fonts"
49
_osfontdir="/usr/share/fonts"
50
51
pkgver() {
52
cd $srcdir
53
grep -e '\\edef\\contextversion' tex/texmf-context/tex/context/base/mkxl/context.mkxl | sed -n 's/.*{\(.*\) .*}/\1/p'
54
}
55
56
prepare() {
57
echo "Starting download or update of ConTeXt distribution"
58
59
chmod +x $srcdir/bin/mtxrun
60
PATH=$srcdir/bin:$srcdir/tex/texmf-${_platform}/bin:$PATH \
61
$srcdir/bin/mtxrun --script $srcdir/bin/mtx-install.lua --update \
62
--server="${_lmtxserverlist}" \
63
--instance="install-lmtx" \
64
|| return 1
65
66
# Make sure the binaries are executable
67
chmod +x $srcdir/tex/texmf-${_platform}/bin/{context,luametatex,mtxrun}
68
69
# Copy mtxrun for next install
70
cp $srcdir/tex/texmf-${_platform}/bin/mtxrun $srcdir/bin
71
cp $srcdir/tex/texmf-context/scripts/context/lua/{mtxrun.lua,mtx-install.lua} $srcdir/bin
72
73
# Install modules
74
PATH=$srcdir/tex/texmf-${_platform}/bin:$PATH \
75
cd $srcdir/tex && texmf-${_platform}/bin/mtxrun --script texmf-context/scripts/context/lua/mtx-install-modules.lua --install ${_modules[@]}
76
77
# Erase cache, must be built by user:
78
PATH=$srcdir/tex/texmf-${_platform}/bin:$PATH \
79
$srcdir/tex/texmf-${_platform}/bin/mtxrun --script texmf-context/scripts/context/lua/mtx-cache --erase --all
80
81
# Generate a setuptex file
82
mkdir -p $srcdir/tex
83
cat <<- _EOF_ > $srcdir/tex/setuptex
84
_OLD_PATH=\$PATH
85
_OLD_CONTEXTDIST=$CONTEXTDIST
86
87
TEXMFOS=${_dest}/texmf-${_platform}
88
export TEXMFOS
89
90
TEXMFCACHE=\$HOME/.cache/context-lmtx
91
export TEXMFCACHE
92
93
# Set variable name to be used in terminal prompt
94
CONTEXTDIST="lmtx"
95
export CONTEXTDIST
96
97
PATH=\$TEXMFOS/bin:\$PATH
98
export PATH
99
100
OSFONTDIR="$_userfontdir;$_osfontdir;"
101
export OSFONTDIR
102
103
resettex () {
104
PATH=\$_OLD_PATH
105
export PATH
106
unset _OLD_PATH
107
108
CONTEXTDIST=\$_OLD_CONTEXTDIST
109
export CONTEXTDIST
110
unset _OLD_CONTEXTDIST
111
112
unset -f resettex
113
}
114
_EOF_
115
}
116
117
118
package()
119
{
120
install -d $pkgdir/$_dest || return 1
121
echo "Copying files"
122
# cp -r does not delete old files that are present in texmf-cache from
123
# previous installation
124
# cp -r --preserve=links $srcdir/tex $pkgdir/$_dest || return 1
125
rsync -az --links --delete --exclude='*.tma' --info=progress2 $srcdir/tex/ $pkgdir/$_dest || return 1
126
}
127
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |