fluxpass

LOW

maintainer orphaned 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads its own source jar and auxiliary files from the project's GitHub repository and official Maven repository, which is normal for AUR packages; the lack of checksums is a quality issue but does not imply active danger as no remote code execution or malicious payload is present.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads its own source jar and auxiliary files from the project's GitHub repository and official Maven repository, which is normal for AUR packages; the lack of checksums is a quality issue but does not imply active danger as no remote code execution or malicious payload is present.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 "javafx-base-${_jfxver}-linux.jar::https://repo1.maven.org/maven2/org/openjfx/javafx-base/${_jfxver}/javafx-base-${_jfxver}-linux.jar"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: unassignedthread <unassignedthread@github.com>
    
      2pkgname=fluxpass
    
      3pkgver=1.0.0
    
      4pkgrel=4
    
      5pkgdesc="GUI password manager for pass (passwordstore.org) with type-based entries"
    
      6arch=('any')
    
      7url="https://github.com/unassignedthread/FluxPass"
    
      8license=('MIT')
    
      9depends=('java-runtime>=17' 'pass' 'gnupg')
    
      10_jfxver=22.0.1
    
      11source=(
    
      12    "${pkgname}-${pkgver}.jar::${url}/releases/download/v${pkgver}/${pkgname}.jar"
    
      13    "${pkgname}.sh::${url}/raw/v${pkgver}/${pkgname}.sh"
    
      14    "${pkgname}.desktop::${url}/raw/v${pkgver}/${pkgname}.desktop"
    
      15    "${pkgname}.svg::${url}/raw/v${pkgver}/${pkgname}.svg"
    
      16    "javafx-base-${_jfxver}-linux.jar::https://repo1.maven.org/maven2/org/openjfx/javafx-base/${_jfxver}/javafx-base-${_jfxver}-linux.jar"
    
      17    "javafx-controls-${_jfxver}-linux.jar::https://repo1.maven.org/maven2/org/openjfx/javafx-controls/${_jfxver}/javafx-controls-${_jfxver}-linux.jar"
    
      18    "javafx-graphics-${_jfxver}-linux.jar::https://repo1.maven.org/maven2/org/openjfx/javafx-graphics/${_jfxver}/javafx-graphics-${_jfxver}-linux.jar"
    
      19    "javafx-fxml-${_jfxver}-linux.jar::https://repo1.maven.org/maven2/org/openjfx/javafx-fxml/${_jfxver}/javafx-fxml-${_jfxver}-linux.jar"
    
      20)
    
      21sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
    
      22
    
      23package() {
    
      24    local _libdir="${pkgdir}/usr/share/java/${pkgname}"
    
      25
    
      26    install -Dm644 "${srcdir}/${pkgname}-${pkgver}.jar" "${_libdir}/${pkgname}.jar"
    
      27    install -Dm644 "${srcdir}/javafx-base-${_jfxver}-linux.jar"       "${_libdir}/lib/javafx-base.jar"
    
      28    install -Dm644 "${srcdir}/javafx-controls-${_jfxver}-linux.jar"   "${_libdir}/lib/javafx-controls.jar"
    
      29    install -Dm644 "${srcdir}/javafx-graphics-${_jfxver}-linux.jar"   "${_libdir}/lib/javafx-graphics.jar"
    
      30    install -Dm644 "${srcdir}/javafx-fxml-${_jfxver}-linux.jar"       "${_libdir}/lib/javafx-fxml.jar"
    
      31
    
      32    install -Dm755 "${srcdir}/${pkgname}.sh"        "${pkgdir}/usr/bin/${pkgname}"
    
      33    install -Dm644 "${srcdir}/${pkgname}.desktop"   "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      34    install -Dm644 "${srcdir}/${pkgname}.svg"       "${pkgdir}/usr/share/icons/hicolor/scalable/apps/${pkgname}.svg"
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2