fiji-latest-bin

LOW

maintainer flomine 0 votes scanned 2026-11-02 10:04:40.702787

View on AUR

Why flagged

Downloads a prebuilt binary zip from downloads.imagej.net, which is the official ImageJ/Fiji project download infrastructure, so the source is plausibly legitimate; the main concern is that it installs a prebuilt binary rather than building from source, but the host is the project's own official domain, making this low risk rather than medium.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): Downloads a prebuilt binary zip from downloads.imagej.net, which is the official ImageJ/Fiji project download infrastructure, so the source is plausibly legitimate; the main concern is that it installs a prebuilt binary rather than building from source, but the host is the project's own official domain, making this low risk rather than medium.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source=("${pkgname}-${pkgver}.zip::https://downloads.imagej.net/fiji/archive/latest/${pkgver/./-}/fiji-latest-linux64-jdk.zip")

PKGBUILD

1 offending line(s) highlighted

      1_pkgname=fiji
    
      2pkgname=fiji-latest-bin
    
      3pkgver=20261030.1817
    
      4pkgrel=1
    
      5epoch=2
    
      6pkgdesc="Fiji is an image processing package, a “batteries-included” distribution of ImageJ2, bundling a lot of plugins which facilitate scientific image analysis."
    
      7arch=('x86_64')
    
      8url='http://fiji.sc/'
    
      9license=('GPL-3.0')
    
      10provides=("fiji=${pkgver}" "fiji-bin=${pkgver}")
    
      11conflicts=('fiji' 'fiji-bin')
    
      12replaces=('fiji-bin')
    
      13depends=(
    
      14  'freetype2'
    
      15  'libnet'
    
      16)
    
      17makedepends=('gendesk')
    
      18optdepends=('ttf-lucida-fonts: fix font rendering, see https://aur.archlinux.org/packages/fiji-bin#comment-1014013')
    
      19options=('!debug' '!strip')
    
      20
    
      21source=("${pkgname}-${pkgver}.zip::https://downloads.imagej.net/fiji/archive/latest/${pkgver/./-}/fiji-latest-linux64-jdk.zip")
    
      22sha256sums=('a1c7996c9ed811966f706223a4aac32283e77e5c683741be2e422d43cf86d133')
    
      23
    
      24
    
      25prepare() {
    
      26  echo "Creating desktop file"
    
      27  gendesk -f -n --pkgname ${_pkgname} \
    
      28    --pkgdesc "${pkgdesc}" \
    
      29    --categories "Graphics;Science;ImageProcessing;" \
    
      30    --icon "${_pkgname}" \
    
      31    --exec ${_pkgname}
    
      32}
    
      33
    
      34package()
    
      35{
    
      36  install -d "${pkgdir}/opt" "${pkgdir}/usr/bin" "${pkgdir}/usr/share/pixmaps"
    
      37  mv "${srcdir}/Fiji" "${pkgdir}/opt/${_pkgname}"
    
      38  cp "${pkgdir}/opt/${_pkgname}/images/icon.png" "${pkgdir}/usr/share/pixmaps/${_pkgname}.png"
    
      39  printf '#!/bin/sh\nexec /opt/%s/fiji-linux-x64 "$@"\n' "${_pkgname}" > "${pkgdir}/usr/bin/${_pkgname}"
    
      40  chmod +x "${pkgdir}/usr/bin/${_pkgname}"  
    
      41  install -Dm644 "${srcdir}/fiji.desktop" "${pkgdir}/usr/share/applications/fiji.desktop"
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-02 10:04:40	Low	3
2026-11-02 10:02:25	Medium	2