filecast

maintainer zoe · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The JAR file is downloaded from the project's official website (onyxbits.de), which is the same domain as the project URL; while the host is not a standard code forge, it is plausibly owned by the developer and the package only installs and runs the project's own code, which is normal for AUR packages.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The JAR file is downloaded from the project's official website (onyxbits.de), which is the same domain as the project URL; while the host is not a standard code forge, it is plausibly owned by the developer and the package only installs and runs the project's own code, which is normal for AUR packages.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 "https://www.onyxbits.de/sites/default/files/download/339/${pkgname}-${pkgver}.jar")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zoe <chp321 at gmail dot com>
    
      2pkgname=filecast
    
      3pkgver=1.0
    
      4pkgrel=4
    
      5arch=('any')
    
      6pkgdesc="Zero setup, cross platform desktop to smartphone transfer tool with GUI - Companion app for Raccoon"
    
      7url="https://www.onyxbits.de/filecast"
    
      8license=('Apache')
    
      9depends=('java-environment')
    
      10source=('filecast.desktop'
    
      11        "https://github.com/onyxbits/FileCast/raw/master/src/main/resources/appicon-64.png"
    
      12        "https://www.onyxbits.de/sites/default/files/download/339/${pkgname}-${pkgver}.jar")
    
      13noextract=("${pkgname}-${pkgver}.jar")
    
      14md5sums=('b728f63da5204098d15b9b189d15082a'  #filecast.desktop
    
      15         '415293972a77a101ddf2392618d85b74'  #appicon-64.png
    
      16         'ae0bb15e5669d16b551c49474dcc2d36') #${pkgname}-${pkgver}.jar
    
      17
    
      18package() {
    
      19  # install files to java shared dir
    
      20  install -Dm644 -t "${pkgdir}/usr/share/java/${pkgname}/"  ${pkgname}-${pkgver}.jar 
    
      21
    
      22  # install icon and desktop database entry
    
      23  install -Dm644 appicon-64.png "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      24  install -Dm644 -t "${pkgdir}/usr/share/applications/"  ${pkgname}.desktop  
    
      25
    
      26  # starter
    
      27  mkdir -p "${pkgdir}/usr/bin"
    
      28  cat > "${pkgdir}/usr/bin/filecast" << \here
    
      29#!/bin/sh
    
      30exec java -Dawt.useSystemAAFontSettings=on -Dswing.defaultlaf=com.sun.java.swing.plaf.gtk.GTKLookAndFeel -Dfilecast.home="$HOME/.Filecast" -jar /usr/share/java/filecast/filecast-pkgver.jar "$@"
    
      31exit $?
    
      32here
    
      33    sed -i "s/pkgver/${pkgver}/" "${pkgdir}/usr/bin/${pkgname}"
    
      34    chmod a+x "${pkgdir}/usr/bin/${pkgname}"
    
      35}
    
      36
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2