cq

maintainer Stefan0436 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged Both the git source and the prebuilt JAR are fetched from a personal DDNS host (aerialworks.ddns.net), which is not an official or well-known distribution channel. The JAR (aosutil-service-SLIB-UTIL) is a binary artifact installed into /usr/lib and loaded at runtime by a Java application — it is executed code, not mere data. The DDNS hostname means the IP it resolves to can change at any time (the owner controls the DNS record), so even the md5sum check only validates what was there at review time. There is no upstream transparency (no GitHub, no Maven Central, no reproducible build). This is a genuine supply-chain concern: a personal DDNS host serving a binary dependency that gets installed system-wide. The cheaper model's MEDIUM rating is correct.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("git+https://aerialworks.ddns.net/ASF/Cyan.git" "https://aerialworks.ddns.net/maven/org/asf/aos/util/service/aosutil-service-SLIB-UTIL/$_aosutilverion/aosutil-service-SLIB-UTIL-$_aosutilverion.jar")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): Both the git source and the prebuilt JAR are fetched from a personal DDNS host (aerialworks.ddns.net), which is not an official or well-known distribution channel. The JAR (aosutil-service-SLIB-UTIL) is a binary artifact installed into /usr/lib and loaded at runtime by a Java application — it is executed code, not mere data. The DDNS hostname means the IP it resolves to can change at any time (the owner controls the DNS record), so even the md5sum check only validates what was there at review time. There is no upstream transparency (no GitHub, no Maven Central, no reproducible build). This is a genuine supply-chain concern: a personal DDNS host serving a binary dependency that gets installed system-wide. The cheaper model's MEDIUM rating is correct.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Stefan Eekhof <stefaneekhof@gmail.com>
    
      2pkgname=cq
    
      3pkgver=1.0.0
    
      4
    
      5_ccfgversion=1.0.0.A19
    
      6_aosutilverion=0.0.0.13 # Needed for CCFG
    
      7
    
      8pkgrel=24
    
      9pkgdesc="CQ -- CCFG Command Line Inteface (Cyan Configurations)"
    
      10arch=( 'any' )
    
      11url=""
    
      12license=('GPL')
    
      13groups=()
    
      14depends=( 'java-environment' )
    
      15makedepends=( 'gradle>=7.0' )
    
      16optdepends=()
    
      17provides=()
    
      18conflicts=()
    
      19replaces=()
    
      20backup=()
    
      21options=()
    
      22install=
    
      23changelog=
    
      24source=("git+https://aerialworks.ddns.net/ASF/Cyan.git" "https://aerialworks.ddns.net/maven/org/asf/aos/util/service/aosutil-service-SLIB-UTIL/$_aosutilverion/aosutil-service-SLIB-UTIL-$_aosutilverion.jar")
    
      25noextract=()
    
      26md5sums=('SKIP'
    
      27         'c725e9bee57d6a63ce27b829cfa1a03e')
    
      28
    
      29build() {
    
      30    cd Cyan
    
      31    cd CCFG
    
      32    echo "rootProject.name = 'CCFG';" > settings.gradle
    
      33    gradle jar
    
      34}
    
      35
    
      36package() {
    
      37    mkdir "$pkgdir/usr/lib/ccfg-cq-libs" -p
    
      38    cp aosutil-service-SLIB-UTIL-$_aosutilverion.jar "$pkgdir/usr/lib/ccfg-cq-libs/aosutil-slib-util.jar"
    
      39    cd Cyan/build/CCFG/Jars
    
      40    cp CCFG-$_ccfgversion.jar "$pkgdir/usr/lib/ccfg-cq-libs/CCFG.jar"
    
      41    cd ../../../CCFG/cq-script
    
      42    mkdir -p "$pkgdir/usr/bin"
    
      43    cp cq "$pkgdir/usr/bin"
    
      44    chmod +x "$pkgdir/usr/bin/cq"
    
      45}
    
      46

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2