doxypress-bin

maintainer hv15 · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads and installs a prebuilt binary tarball from download.copperspice.com, which is the official CopperSpice project download host (CopperSpice is the legitimate upstream vendor of DoxyPress). The host is not a random personal server — CopperSpice is a well-known Qt-fork project and DoxyPress is their documented Doxygen fork. A sha512 checksum is provided, which pins the specific binary. However, the concern is real in the sense that: (1) a prebuilt binary is being installed directly to /opt and added to PATH via profile.d, (2) there is no source build, so the binary contents cannot be audited, and (3) the tarball is extracted with noextract and then unpacked manually with bsdtar. This is a classic -bin AUR package pattern. The host (download.copperspice.com) is the vendor's own distribution server, not an unofficial or personal host, which significantly reduces supply-chain risk compared to a random GitHub user's releases. The checksum provides integrity verification. This is standard practice for -bin AUR packages from official vendor hosts. The cheaper model's concern about 'non-standard host' is somewhat of a false positive since this IS the official upstream vendor host. That said, installing an unauditable prebuilt binary always carries inherent medium-level supply-chain risk — if the vendor's download server were compromised, the checksum would be the only protection (and it would fail). Rating as medium is defensible but borderline; the pattern is c

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("https://download.copperspice.com/doxypress/binary/${pkgname%-bin}-${pkgver}-arch-x64.tar.bz2")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads and installs a prebuilt binary tarball from download.copperspice.com, which is the official CopperSpice project download host (CopperSpice is the legitimate upstream vendor of DoxyPress). The host is not a random personal server — CopperSpice is a well-known Qt-fork project and DoxyPress is their documented Doxygen fork. A sha512 checksum is provided, which pins the specific binary. However, the concern is real in the sense that: (1) a prebuilt binary is being installed directly to /opt and added to PATH via profile.d, (2) there is no source build, so the binary contents cannot be audited, and (3) the tarball is extracted with noextract and then unpacked manually with bsdtar. This is a classic -bin AUR package pattern. The host (download.copperspice.com) is the vendor's own distribution server, not an unofficial or personal host, which significantly reduces supply-chain risk compared to a random GitHub user's releases. The checksum provides integrity verification. This is standard practice for -bin AUR packages from official vendor hosts. The cheaper model's concern about 'non-standard host' is somewhat of a false positive since this IS the official upstream vendor host. That said, installing an unauditable prebuilt binary always carries inherent medium-level supply-chain risk — if the vendor's download server were compromised, the checksum would be the only protection (and it would fail). Rating as medium is defensible but borderline; the pattern is c

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Hans-Nikolai Viessmann <hans AT viess DOT mn>
    
      2pkgname=doxypress-bin
    
      3pkgver=2.1.0
    
      4pkgrel=1
    
      5pkgdesc="A fork of Doxygen, with improved output and support for clang parsing"
    
      6arch=('x86_64')
    
      7url="https://www.copperspice.com/documentation-doxypress.html"
    
      8license=('GPL-2.0-only')
    
      9depends=('clang' 'libxi' 'fontconfig' 'xcb-util-renderutil' 'xcb-util-wm' 'libxkbcommon-x11'
    
      10         'libglvnd' 'libxrandr' 'libxcursor' 'xcb-util-keysyms' 'libxinerama' 'libsm'
    
      11         'xcb-util-image' 'libjpeg-turbo')
    
      12provides=('doxypress')
    
      13conflicts=('doxypress')
    
      14replaces=('doxypress')
    
      15source=("https://download.copperspice.com/doxypress/binary/${pkgname%-bin}-${pkgver}-arch-x64.tar.bz2")
    
      16sha512sums=('fa5fa2185b390e31af641537e702ebbc7d00c0988938bd2a9837cce21d4df9cd73eda433b436c8f5ac509780976b7bee44eea55038529febbfa9ea152031dcb3')
    
      17noextract=("${pkgname%-bin}-${pkgver}-arch-x64.tar.bz2")
    
      18
    
      19package() {
    
      20	cd "$srcdir"
    
      21
    
      22    # setup PATH through profile.d
    
      23    install -dm0755 "${pkgdir}/etc/profile.d"
    
      24    echo "export PATH=\$PATH:/opt/${pkgname%-bin}" > "${pkgdir}/etc/profile.d/${pkgname%-bin}.sh"
    
      25
    
      26    # unpack the archive
    
      27    install -d "${pkgdir}/opt/${pkgname%-bin}"
    
      28    bsdtar --uname root --gname root -xf "${pkgname%-bin}-${pkgver}-arch-x64.tar.bz2" -C "${pkgdir}/opt/${pkgname%-bin}"
    
      29}
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2