drjava-svetovid

maintainer dusansimic · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a JAR file and supporting scripts from the project's official domain svetovid.org; while the host is not on a standard whitelist, it is plausibly the project's own infrastructure, and the JAR is part of the legitimate software distribution, not an obfuscated payload or remote code execution mechanism.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a JAR file and supporting scripts from the project's official domain svetovid.org; while the host is not on a standard whitelist, it is plausibly the project's own infrastructure, and the JAR is part of the legitimate software distribution, not an obfuscated payload or remote code execution mechanism.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=('https://svetovid.org/lib/drjava-with-svetovid-lib.jar'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Dušan Simić <dusan.simic1810@gmail.com>
    
      2
    
      3pkgname=drjava-svetovid
    
      4pkgver=20140826
    
      5pkgrel=1
    
      6pkgdesc="A lightweight development environment for writing Java programs including Svetovid"
    
      7arch=('any')
    
      8url="https://svetovid.org/lib/drjava.html"
    
      9license=('BSD')
    
      10depends=('bash' 'java-environment')
    
      11source=('https://svetovid.org/lib/drjava-with-svetovid-lib.jar'
    
      12        'drjava-svetovid.sh'
    
      13        'drjava-svetovid.desktop'
    
      14        'LICENSE')
    
      15sha512sums=('f8be92a41159ccb4417726f6b4896628927cd9e51fda54335b5006bf8d921081ab9fd09c1677e0e870e048471778012059326b749f3b0318c3d46b8fd504a39a'
    
      16            '619e77fbb1970f68c4de5f0d2d719220f9fb5c0fd15ec746b1c1b181bc757ffe466d09d6deb394c806bb4cc82f091d3e21950e7f82bb8ff9c2a69073d5537663'
    
      17            '553614cf30355c09cce2f5d4892486c0687336a1077c5df45ad476fcd6bbb0c98fc0932ebd7699fa236f826c7503d719b0bdd7cd37a4358002573096cee0cfeb'
    
      18            '8beb6de3b073857d0eba23c28fcfa7bee669b6caaf8eeb5022f9a78c48d2c8c726bd2448993edcdd8db8e56b3e816d64e21fdfaf392e0440122db67446fada8f')
    
      19
    
      20package() {
    
      21	cd ${srcdir}
    
      22
    
      23	install -Dm644 drjava-with-svetovid-lib.jar ${pkgdir}/usr/share/java/${pkgname}/${pkgname}.jar
    
      24	install -Dm755 drjava-svetovid.sh ${pkgdir}/usr/bin/${pkgname}
    
      25	install -Dm644 LICENSE ${pkgdir}/usr/share/license/${pkgname}/LICENSE
    
      26	install -Dm644 edu/rice/cs/drjava/ui/icons/drjava64.png ${pkgdir}/usr/share/pixmaps/${pkgname}.png
    
      27	install -Dm644 drjava-svetovid.desktop ${pkgdir}/usr/share/applications/${pkgname}.desktop
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2