davmail-trunk-bin

LOW

maintainer Rhinoceros 0 votes scanned 2026-09-22 03:38:16.605897

View on AUR

Why flagged

Downloads a prebuilt JAR/zip from AppVeyor CI (the project's own official CI infrastructure for mguessan/davmail) with a SKIP'd checksum, which is mildly concerning but not from an unrelated swappable host; the rest of the package installs bundled desktop/service files and extracts icons from the JAR — no obfuscated payloads or exfiltration.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads a prebuilt JAR/zip from AppVeyor CI (the project's own official CI infrastructure for mguessan/davmail) with a SKIP'd checksum, which is mildly concerning but not from an unrelated swappable host; the rest of the package installs bundled desktop/service files and extracts icons from the JAR — no obfuscated payloads or exfiltration.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("https://ci.appveyor.com/api/projects/mguessan/davmail/artifacts/dist%2F$_pkgname-$_basever-trunk.zip?job=Environment%3A%20JAVA_HOME%3DC%3A%5CProgram%20Files%5CJava%5Cjdk1.8.0"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Rhinoceros <https://aur.archlinux.org/account/rhinoceros>
    
      2# Contributor: Hy Goldsher <hyness-at-freshlegacycode-dot-org>
    
      3
    
      4pkgname=davmail-trunk-bin
    
      5_pkgname=davmail
    
      6_basever=7.0.0
    
      7pkgver=7.0.0.trunk.983
    
      8pkgrel=1
    
      9pkgdesc="a POP/IMAP/SMTP/Caldav/LDAP gateway for the exchange service"
    
      10arch=('i686' 'x86_64' 'armv7h' 'aarch64')
    
      11url="http://$_pkgname.sourceforge.net/"
    
      12license=('GPL')
    
      13makedepends=('unzip' 'curl') # curl for pkgver()
    
      14depends=('java-runtime')
    
      15optdepends=('java-openjfx: Office 365 browser based authentication'
    
      16            'swt: Fix issues with the tray icon')
    
      17provides=("$_pkgname")
    
      18conflicts=("$_pkgname" "$_pkgname-git")
    
      19source=("https://ci.appveyor.com/api/projects/mguessan/davmail/artifacts/dist%2F$_pkgname-$_basever-trunk.zip?job=Environment%3A%20JAVA_HOME%3DC%3A%5CProgram%20Files%5CJava%5Cjdk1.8.0"
    
      20        $_pkgname.desktop
    
      21        $_pkgname@.system_service
    
      22        $_pkgname@.user_service)
    
      23md5sums=('SKIP'
    
      24         '1df37a6120d88de8df3cb735977336ba'
    
      25         '8d373851babe1d8bb860228c8b4db702'
    
      26         '271e9e66dfdb496d242c9a6102937c65')
    
      27install=$_pkgname.install
    
      28
    
      29pkgver() {
    
      30    buildver=$(curl -s "https://ci.appveyor.com/api/projects/mguessan/davmail" \
    
      31      | grep -oP '"version":\s*"\K[^"]+')
    
      32    printf '%s.trunk.%s' "$_basever" "$buildver"
    
      33}
    
      34
    
      35package() {
    
      36  install -d $pkgdir/{usr/share/$_pkgname/lib,usr/bin,etc/$_pkgname}
    
      37  install -Dm644 $_pkgname.jar $pkgdir/usr/share/$_pkgname/
    
      38  install -D lib/* $pkgdir/usr/share/$_pkgname/lib
    
      39  install -Dm755 $srcdir/$_pkgname $pkgdir/usr/share/$_pkgname
    
      40  install -Dm755 $srcdir/$_pkgname $pkgdir/usr/bin/
    
      41  install -Dm644 $srcdir/$_pkgname.desktop ${pkgdir}/usr/share/applications/$_pkgname.desktop
    
      42  install -Dm644 $srcdir/$_pkgname\@.system_service ${pkgdir}/usr/lib/systemd/system/$_pkgname\@.service
    
      43  install -Dm644 $srcdir/$_pkgname\@.user_service ${pkgdir}/usr/lib/systemd/user/$_pkgname\@.service
    
      44
    
      45  # Create icons
    
      46  unzip -q $_pkgname.jar tray.png tray32.png tray48.png tray128.png
    
      47  install -Dm644 tray.png ${pkgdir}/usr/share/icons/hicolor/16x16/apps/$_pkgname.png
    
      48  install -Dm644 tray32.png ${pkgdir}/usr/share/icons/hicolor/32x32/apps/$_pkgname.png
    
      49  install -Dm644 tray48.png ${pkgdir}/usr/share/icons/hicolor/48x48/apps/$_pkgname.png
    
      50  install -Dm644 tray128.png ${pkgdir}/usr/share/icons/hicolor/128x128/apps/$_pkgname.png
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-22 03:38:16	Low	3
2026-09-22 03:36:46	Medium	3