eclipse-pmd

maintainer Raimar · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt JAR files from the project's official GitHub Pages site, which is a plausible project-owned host; while not on a standard forge URL, it is not inherently suspicious, and the files are part of the official PMD Eclipse plugin distribution, with verified checksums, posing low risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt JAR files from the project's official GitHub Pages site, which is a plausible project-owned host; while not on a standard forge URL, it is not inherently suspicious, and the files are part of the official PMD Eclipse plugin distribution, with verified checksums, posing low risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 "feature.jar::https://pmd.github.io/pmd-eclipse-plugin-p2-site/${pkgver}.${_buildtime}/features/net.sourceforge.pmd.eclipse_${pkgver}.${_buildtime}.jar"

PKGBUILD

1 offending line(s) highlighted

      1#Maintainer: Raimar Buehmann <raimar _at_ buehmann _dot_ de>
    
      2
    
      3pkgname=eclipse-pmd
    
      4pkgver=7.18.0
    
      5_buildtime=v20251031-1002-r
    
      6pkgrel=1
    
      7pkgdesc='PMD static source code analysis (Java, XML, ...) plugin for Eclipse IDE'
    
      8arch=('any')
    
      9url='http://pmd.sourceforge.net/'
    
      10license=('BSD' 'Apache')
    
      11depends=('eclipse>=4.5.0')
    
      12options=('!strip')
    
      13source=(
    
      14	"feature.jar::https://pmd.github.io/pmd-eclipse-plugin-p2-site/${pkgver}.${_buildtime}/features/net.sourceforge.pmd.eclipse_${pkgver}.${_buildtime}.jar"
    
      15	"plugin.jar::https://pmd.github.io/pmd-eclipse-plugin-p2-site/${pkgver}.${_buildtime}/plugins/net.sourceforge.pmd.eclipse.plugin_${pkgver}.${_buildtime}.jar"
    
      16	"license.txt::http://sourceforge.net/p/pmd/code/ci/master/tree/LICENSE?format=raw"
    
      17)
    
      18noextract=(feature.jar plugin.jar license.txt)
    
      19sha256sums=('7339fd1ae85429fc0301207456265d7549ada3054800240e6138f9e7695c69be'
    
      20            '3de830c6f58b3457065209cf3fcb5287774436f7b020ed671b2167a01621474a'
    
      21            '296dae48eae5658f449a89cf512b8e05386c9c5adfb23d74cfb24efa145625db')
    
      22
    
      23package() {
    
      24	_dest=$pkgdir/usr/lib/eclipse/dropins/${pkgname/eclipse-}/eclipse
    
      25	_subfolder=$_dest/features/net.sourceforge.pmd.eclipse_${pkgver}.${_buildtime}
    
      26	install -dm755 $_subfolder
    
      27	cd $_subfolder
    
      28	# extract feature
    
      29	jar xf $srcdir/feature.jar || return 1
    
      30	# copy plugin
    
      31	install -Dm644 $srcdir/plugin.jar $_dest/plugins/net.sourceforge.pmd.eclipse.plugin_${pkgver}.${_buildtime}.jar
    
      32	install -Dm644 $srcdir/license.txt $pkgdir/usr/share/licenses/eclipse-pmd/license.txt
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2