dict-dalf

maintainer rid3rius · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a noarch RPM from ALT Linux's build task server (git.altlinux.org), extracts it, and installs only two data files: dalf.dict.dz and dalf.index — these are dictionary database files (compressed text data and an index), not executed binaries or libraries. The sha512sum is pinned, so the artifact cannot be silently replaced without detection. The host is ALT Linux's official build infrastructure, not a random personal server. The only concern is that ALT Linux's build task URLs are somewhat ephemeral/unofficial compared to a proper release mirror, and the license is listed as 'unknown'. However, since only pure data files are installed (never executed), the supply-chain risk is minimal — even a malicious replacement could only corrupt dictionary lookups, not execute code. This is sloppy packaging (should use an official upstream source, license is unknown) but not a security risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The package downloads a noarch RPM from ALT Linux's build task server (git.altlinux.org), extracts it, and installs only two data files: dalf.dict.dz and dalf.index — these are dictionary database files (compressed text data and an index), not executed binaries or libraries. The sha512sum is pinned, so the artifact cannot be silently replaced without detection. The host is ALT Linux's official build infrastructure, not a random personal server. The only concern is that ALT Linux's build task URLs are somewhat ephemeral/unofficial compared to a proper release mirror, and the license is listed as 'unknown'. However, since only pure data files are installed (never executed), the supply-chain risk is minimal — even a malicious replacement could only corrupt dictionary lookups, not execute code. This is sloppy packaging (should use an official upstream source, license is unknown) but not a security risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://git.altlinux.org/tasks/139776/build/100/x86_64/rpms/dict-dalf-0.1-alt2.noarch.rpm")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Riderius <riderius.help@gmail.com>
    
      2
    
      3pkgname=dict-dalf
    
      4pkgver=1.0
    
      5pkgrel=1
    
      6pkgdesc="Dal's Russian Dictionary"
    
      7arch=('any')
    
      8license=('unknown')
    
      9optdepends=('dictd: dict client and server')
    
      10provides=('dictd-dalf')
    
      11conflicts=('dictd-dalf')
    
      12# Install file from dict-gcide (https://aur.archlinux.org/cgit/aur.git/tree/dict-gcide.install?h=dict-gcide)
    
      13install="${pkgname}.install"
    
      14source=("https://git.altlinux.org/tasks/139776/build/100/x86_64/rpms/dict-dalf-0.1-alt2.noarch.rpm")
    
      15sha512sums=('e8bcd66da3d8b097cd0197e1d3366506be26ea84cd2276053a675d10b2d23f6865f75287dc6a7c15bbaf902ec8eed8b6eaaafb4bdd1f79ff52868e515517108f')
    
      16
    
      17package() {
    
      18	cd "${srcdir}/usr/share/dictd"
    
      19	install -m 0755 -d "${pkgdir}/usr/share/dictd"
    
      20	install -m 0644 -t "${pkgdir}/usr/share/dictd/" dalf.{dict.dz,index}
    
      21}
    
      22

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2