cpmtools

maintainer libele · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a tarball from the project's own official domain, building from source is normal for AUR, and the host, while not whitelisted, is plausibly the project's legitimate site.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the project's own official domain, building from source is normal for AUR, and the host, while not whitelisted, is plausibly the project's legitimate site.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("http://www.moria.de/~michael/cpmtools/files/${pkgname}-${pkgver}.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: libele <libele@disroot.org>
    
      2# Contributor:  Beej <beej@beej.us>
    
      3# Contributor:  Michiel Broek <mbse at mbse eu>
    
      4
    
      5pkgname=cpmtools
    
      6pkgver=2.23
    
      7pkgrel=1
    
      8pkgdesc="Tools to access CP/M disks"
    
      9arch=('i686' 'x86_64')
    
      10url="http://www.moria.de/~michael/cpmtools/"
    
      11license=('GPL')
    
      12depends=(ncurses)
    
      13source=("http://www.moria.de/~michael/cpmtools/files/${pkgname}-${pkgver}.tar.gz"
    
      14	'ecsys.drives'
    
      15	'prodos.drives'
    
      16	'z80pack.drives')
    
      17sha256sums=('7839b19ac15ba554e1a1fc1dbe898f62cf2fd4db3dcdc126515facc6b929746f'
    
      18            '42fbaa5d733d4da255f6e3f9cb8e844f8dae6cd9858c9aa364213e34f45934d9'
    
      19            '10899a2dd2a46e34e278c3aa07d4d65c66c7d885d0d8df8c1c255c2af06d3c8e'
    
      20            '5969c802ba8d6cdeadb96190b15a6e58ba365fdcf42723581a350f54ea221c8d')
    
      21
    
      22build() {
    
      23  cd "${srcdir}/${pkgname}-${pkgver}"
    
      24  ./configure  --prefix=/usr || exit 1
    
      25  make
    
      26}
    
      27
    
      28package() {
    
      29  cd "${srcdir}/${pkgname}-${pkgver}"
    
      30
    
      31  mkdir -p "${pkgdir}"/usr/bin
    
      32  mkdir -p "${pkgdir}"/usr/share/man/man1
    
      33  mkdir -p "${pkgdir}"/usr/share/man/man5
    
      34  mkdir -p "${pkgdir}/usr/share/doc/${pkgname}-${pkgver}"
    
      35
    
      36  make BINDIR="${pkgdir}"/usr/bin MANDIR="${pkgdir}"/usr/share/man prefix="${pkgdir}"/usr install
    
      37  cat "${srcdir}"/*.drives >> "${pkgdir}"/usr/share/diskdefs
    
      38
    
      39  cp -a COPYING INSTALL NEWS README* "${pkgdir}/usr/share/doc/${pkgname}-${pkgver}"
    
      40  chmod 644 "${pkgdir}/usr/share/doc/${pkgname}-${pkgver}"/*
    
      41}
    
      42
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2