context-lmtx-bin

maintainer adityam · 1 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The package downloads a source archive from a non-whitelisted but project-associated host (lmtx.pragma-ade.nl) used by the official ConTeXt project; the source is a build artifact but not an obfuscated or untrusted executable, and the build process uses standard project tooling to update and install components.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source archive from a non-whitelisted but project-associated host (lmtx.pragma-ade.nl) used by the official ConTeXt project; the source is a build artifact but not an obfuscated or untrusted executable, and the build process uses standard project tooling to update and install components.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:37 source=("https://${_lmtxserver}/install-lmtx/${_zipfile}")

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Aditya Mahajan <adityam at umich dot edu>
2
3pkgname=context-lmtx-bin
4pkgver=2025.08.17
5pkgrel=1
6pkgdesc="ConTeXt LuaMetaTeX distribution"
7url="http://www.contextgarden.net"
8license=('GPL')
9arch=('i686' 'x86_64')
10optdepends=('ghostscript: support for PS and EPS images'
11 'graphicsmagick: support for GIF and TIFF images'
12 'inkscape: support for SVG images'
13 'pstoedit: support for metapost outlines for fonts'
14 'zint: support for barcodes'
15 'curl: loading remote content')
16
17makedepends=('rsync' 'curl')
18conflicts=()
19replaces=()
20backup=()
21
22install=context-lmtx-bin.install
23options=(!strip)
24
25# ConTeXt minimals uses a different naming convention for architectures
26
27declare -A _platform_map
28
29_platform_map['i686']='linux-32'
30_platform_map['x86_64']='linux-64'
31_platform=${_platform_map[$CARCH]}
32
33_lmtxserver=lmtx.pragma-ade.nl
34_lmtxserverlist=lmtx.contextgarden.net,lmtx.pragma-ade.com,lmtx.pragma-ade.nl
35_zipfile=context-${_platform}.zip
36
37source=("https://${_lmtxserver}/install-lmtx/${_zipfile}")
38md5sums=('SKIP')
39
40# List of _modules to be installed
41# Can use '--all' to install all modules
42_modules=('filter' 'visualcounter' 'vim' 'tikz' 'typescripts')
43
44_dest=/opt/context-lmtx
45
46# Font directories
47_texlivefontdir="/usr/share/texmf-dist/fonts/"
48_userfontdir="\$HOME/.fonts"
49_osfontdir="/usr/share/fonts"
50
51pkgver() {
52 cd $srcdir
53 grep -e '\\edef\\contextversion' tex/texmf-context/tex/context/base/mkxl/context.mkxl | sed -n 's/.*{\(.*\) .*}/\1/p'
54}
55
56prepare() {
57 echo "Starting download or update of ConTeXt distribution"
58
59 chmod +x $srcdir/bin/mtxrun
60 PATH=$srcdir/bin:$srcdir/tex/texmf-${_platform}/bin:$PATH \
61 $srcdir/bin/mtxrun --script $srcdir/bin/mtx-install.lua --update \
62 --server="${_lmtxserverlist}" \
63 --instance="install-lmtx" \
64 || return 1
65
66 # Make sure the binaries are executable
67 chmod +x $srcdir/tex/texmf-${_platform}/bin/{context,luametatex,mtxrun}
68
69 # Copy mtxrun for next install
70 cp $srcdir/tex/texmf-${_platform}/bin/mtxrun $srcdir/bin
71 cp $srcdir/tex/texmf-context/scripts/context/lua/{mtxrun.lua,mtx-install.lua} $srcdir/bin
72
73 # Install modules
74 PATH=$srcdir/tex/texmf-${_platform}/bin:$PATH \
75 cd $srcdir/tex && texmf-${_platform}/bin/mtxrun --script texmf-context/scripts/context/lua/mtx-install-modules.lua --install ${_modules[@]}
76
77 # Erase cache, must be built by user:
78 PATH=$srcdir/tex/texmf-${_platform}/bin:$PATH \
79 $srcdir/tex/texmf-${_platform}/bin/mtxrun --script texmf-context/scripts/context/lua/mtx-cache --erase --all
80
81 # Generate a setuptex file
82 mkdir -p $srcdir/tex
83 cat <<- _EOF_ > $srcdir/tex/setuptex
84 _OLD_PATH=\$PATH
85 _OLD_CONTEXTDIST=$CONTEXTDIST
86
87 TEXMFOS=${_dest}/texmf-${_platform}
88 export TEXMFOS
89
90 TEXMFCACHE=\$HOME/.cache/context-lmtx
91 export TEXMFCACHE
92
93 # Set variable name to be used in terminal prompt
94 CONTEXTDIST="lmtx"
95 export CONTEXTDIST
96
97 PATH=\$TEXMFOS/bin:\$PATH
98 export PATH
99
100 OSFONTDIR="$_userfontdir;$_osfontdir;"
101 export OSFONTDIR
102
103 resettex () {
104 PATH=\$_OLD_PATH
105 export PATH
106 unset _OLD_PATH
107
108 CONTEXTDIST=\$_OLD_CONTEXTDIST
109 export CONTEXTDIST
110 unset _OLD_CONTEXTDIST
111
112 unset -f resettex
113 }
114_EOF_
115}
116
117
118package()
119{
120 install -d $pkgdir/$_dest || return 1
121 echo "Copying files"
122 # cp -r does not delete old files that are present in texmf-cache from
123 # previous installation
124 # cp -r --preserve=links $srcdir/tex $pkgdir/$_dest || return 1
125 rsync -az --links --delete --exclude='*.tma' --info=progress2 $srcdir/tex/ $pkgdir/$_dest || return 1
126}
127

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2
2026-07-15 00:09:25 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion