fdlog

maintainer not_anonymous · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a zip file from Google Drive, which is non-standard but not inherently malicious. The package is a Python/Tk ham radio logging application (interpreted code, not a compiled binary), so the main risk is the content of the zip itself. Both md5 and sha256 checksums are provided, which pins the exact file content. The package installs Python scripts with 644 permissions and a shell wrapper with 755, so nothing unusual is executed at build time. Google Drive is commonly used by hobbyist/ham radio developers who lack dedicated hosting. The real concern is that Google Drive links can be silently replaced by the file owner, but the dual checksums mitigate this for the pinned version. This is sloppy packaging (non-standard host, commented-out alternatives) but not a genuine supply-chain threat beyond what the checksums already address. Rating low rather than medium because the payload is interpreted Python source (not a pre-compiled binary) and is checksummed with two independent hash algorithms.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The source is a zip file from Google Drive, which is non-standard but not inherently malicious. The package is a Python/Tk ham radio logging application (interpreted code, not a compiled binary), so the main risk is the content of the zip itself. Both md5 and sha256 checksums are provided, which pins the exact file content. The package installs Python scripts with 644 permissions and a shell wrapper with 755, so nothing unusual is executed at build time. Google Drive is commonly used by hobbyist/ham radio developers who lack dedicated hosting. The real concern is that Google Drive links can be silently replaced by the file owner, but the dual checksums mitigate this for the pinned version. This is sloppy packaging (non-standard host, commented-out alternatives) but not a genuine supply-chain threat beyond what the checksums already address. Rating low rather than medium because the payload is interpreted Python source (not a pre-compiled binary) and is checksummed with two independent hash algorithms.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("${pkgname}${pkgver}-${pkgverex}.zip::https://drive.google.com/uc?export=download&id=1Jry1BzQcMC7JJblhR8JtetDBI7R8Xp9k"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: not_anonymous <nmlibertarian@gmail.com>
    
      2# Contributor: Vitaliy Berdinskikh ur6lad[at]i.ua
    
      3# Original Submitter: Bob Finch <w9ya@qrparci.net>
    
      4
    
      5pkgname=fdlog
    
      6pkgver=155m
    
      7pkgverex=rc7
    
      8pkgrel=1
    
      9pkgdesc="Ham Radio - Field Day Logger with networked nodes"
    
      10arch=('any')
    
      11url="http://www.fdlog.info"
    
      12license=('GPL-2.0-or-later')
    
      13depends=('python3' 'python-pyserial' 'python-pyaudio' 'tk' 'epdfview' 'sqlite' 'hamradio-menus')
    
      14source=("${pkgname}${pkgver}-${pkgverex}.zip::https://drive.google.com/uc?export=download&id=1Jry1BzQcMC7JJblhR8JtetDBI7R8Xp9k"
    
      15#https://drive.google.com/file/d/1Jry1BzQcMC7JJblhR8JtetDBI7R8Xp9k"
    
      16#https://drive.google.com/uc?export=download&id=1k3wuKxC1CcbAijApiLpLTZGx4wbsyaiw"
    
      17#${url}/files/$pkgname$pkgver.zip
    
      18#	${url}/files/arrl_sect.txt
    
      19#	http://www.arrl.org/files/file/Field-Day/2017/2017%20Rules.pdf
    
      20#	https://www.arrl.org/files/file/Regulatory/Band%20Chart/Band%20Chart%20-%2011X17%20Color.pdf
    
      21#	diff.linux.patch.de.kd8kbu
    
      22	$pkgname.1
    
      23	$pkgname.desktop
    
      24	$pkgname.png)
    
      25
    
      26#prepare() {
    
      27#	cd $srcdir/${pkgname}$pkgver
    
      28#
    
      29#	mv README.txt readme.txt
    
      30#	rm GPL.txt
    
      31#
    
      32#	sed -i -e 's:os.startfile:os.system:' fdlog.py
    
      33#	sed -i -e 's:fdrules.pdf:epdfview fdrules.pdf:' fdlog.py
    
      34#	sed -i -e 's:bands.pdf:epdfview bands.pdf:' fdlog.py
    
      35#
    
      36#	patch -p0 < ../diff.linux.patch.de.kd8kbu
    
      37#}
    
      38
    
      39package() {
    
      40#	cd $srcdir/${pkgname}$pkgver
    
      41	cd $srcdir/${pkgname}${pkgver}-${pkgverex}
    
      42
    
      43	mkdir -p $pkgdir/usr/share/$pkgname
    
      44	install -m 644 * $pkgdir/usr/share/$pkgname/
    
      45#	install -m 644 ../arrl_sect.txt $pkgdir/usr/share/$pkgname/arrl_sect.txt
    
      46#	install -m 644 ../2017%20Rules.pdf $pkgdir/usr/share/$pkgname/fdrules.pdf
    
      47#	install -m 644 ../Band%20Chart%20-%2011X17%20Color.pdf $pkgdir/usr/share/$pkgname/bands.pdf
    
      48	install -D -m 755 ../$pkgname.1 $pkgdir/usr/bin/$pkgname
    
      49
    
      50	mkdir -p $pkgdir/usr/share/{applications,pixmaps}
    
      51	install -m644 ../*.desktop $pkgdir/usr/share/applications/
    
      52	install -m644 ../*.png $pkgdir/usr/share/pixmaps/
    
      53}
    
      54md5sums=('2106c793f108e54d01db30fea4ffe4b8'
    
      55         'abad30875130ace4210e24db7008c1f5'
    
      56         'ed55981d519bc7a1644183d913ba54a0'
    
      57         '222f239adce839cd07d4fff44fac3ee8')
    
      58sha256sums=('2c806ffcf13b1ff74c17c545f2d06a6d10fbc0fcd1eb96028724febf8b3269f8'
    
      59            '86ccf638aabeccbbd0c13b38a413e18a18a3ec59a92a46752fea852924da9c04'
    
      60            'aea54578f79ef0aa7ca91eb5a52ddad92429379d40d97fc9f87234073bfc81ce'
    
      61            '5e3e7867385997b5a11c231d32f9429e09f234f50882ff8385241f4cbf92b500')
    
      62

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2