edisyn-bin

maintainer SpotlightKid · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The JAR is downloaded from people.cs.gmu.edu/~eclab/, which is the personal university web space of Sean Luke, the primary author of Edisyn (eclab = EC Lab at George Mason University). This is a well-known pattern for academic software where the author hosts releases on their university pages rather than GitHub releases. The sha256sum is pinned, so any tampering would be caught. The JAR is installed as data (not executed directly by the build process) and is only run at user invocation via a wrapper shell script. While the host is not GitHub Releases, it is the author's own institutional hosting and matches the upstream project URL (github.com/eclab/edisyn). This is sloppy/non-standard packaging (no versioned URL, relies on a mutable upstream path) but not a genuine supply-chain threat beyond what any binary AUR package carries.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The JAR is downloaded from people.cs.gmu.edu/~eclab/, which is the personal university web space of Sean Luke, the primary author of Edisyn (eclab = EC Lab at George Mason University). This is a well-known pattern for academic software where the author hosts releases on their university pages rather than GitHub releases. The sha256sum is pinned, so any tampering would be caught. The JAR is installed as data (not executed directly by the build process) and is only run at user invocation via a wrapper shell script. While the host is not GitHub Releases, it is the author's own institutional hosting and matches the upstream project URL (github.com/eclab/edisyn). This is sloppy/non-standard packaging (no versioned URL, relies on a mutable upstream path) but not a genuine supply-chain threat beyond what any binary AUR package carries.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("$_pkgname-$pkgver.jar::https://people.cs.gmu.edu/~eclab/projects/$_pkgname/$_pkgname.jar"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Christopher Arndt <aur -at- chrisarndt -dot- de>
    
      2
    
      3_pkgname=edisyn
    
      4pkgname=$_pkgname-bin
    
      5pkgver=36
    
      6pkgrel=1
    
      7pkgdesc='A cross-platform synthesizer patch editor library'
    
      8arch=(i686 x86_64)
    
      9url='https://github.com/eclab/edisyn/'
    
      10license=(Apache-2.0)
    
      11depends=('java-runtime>=20')
    
      12provides=($_pkgname)
    
      13conflicts=($_pkgname)
    
      14source=("$_pkgname-$pkgver.jar::https://people.cs.gmu.edu/~eclab/projects/$_pkgname/$_pkgname.jar"
    
      15        "$_pkgname.desktop"
    
      16        "$_pkgname.sh")
    
      17noextract=("$_pkgname-$pkgver.jar")
    
      18sha256sums=('e3cfceb320bb3aee72601c0c828b4f23fcdadba0566145e5c0bc23ca037235c6'
    
      19            '6545bfc5fb5e41d1f6917c0c40145f8168c5d205a70ad1fb6810cf57c68fb618'
    
      20            'e8154776a330ab82a6daf48dd9f6f09e7a923ccfdd698a6645cbca1d2b1d7be1')
    
      21
    
      22package() {
    
      23  install -vDm 644 "$srcdir"/$_pkgname-$pkgver.jar \
    
      24    "$pkgdir"/usr/share/java/${_pkgname}/$_pkgname.jar
    
      25  install -vDm 755 "$srcdir"/$_pkgname.sh \
    
      26    "$pkgdir"/usr/bin/$_pkgname
    
      27  install -vDm 644 "$srcdir"/$_pkgname.desktop \
    
      28    -t "$pkgdir"/usr/share/applications
    
      29}
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2