frink-lang-bin

LOW

maintainer typedrat 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads the official JAR and data files from the project's own domain (frinklang.org), which is the legitimate source; the files are installed as-is and not executed during build, and the SKIP'd checksums are a packaging weakness but do not imply malicious content given the trusted context.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads the official JAR and data files from the project's own domain (frinklang.org), which is the legitimate source; the files are installed as-is and not executed during build, and the SKIP'd checksums are a packaging weakness but do not imply malicious content given the trusted context.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 "$pkgname.jar::https://frinklang.org/frinkjar/frink.jar"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Alexis Williams <alexis@typedr.at>
    
      2pkgname=frink-lang-bin
    
      3pkgver=20240227
    
      4pkgrel=2
    
      5pkgdesc="A practical calculating tool and programming language."
    
      6arch=('any')
    
      7url="https://frinklang.org/"
    
      8license=('unknown')
    
      9depends=('bash' 'java-runtime')
    
      10makedepends=('awk' 'imagemagick' 'unzip')
    
      11optdepends=('rlwrap: readline support for the command-line shell')
    
      12source=(
    
      13	"$pkgname.jar::https://frinklang.org/frinkjar/frink.jar"
    
      14	"$pkgname-unitnames.txt::https://frinklang.org/frinkjar/unitnames.txt"
    
      15	"$pkgname-functionnames.txt::https://frinklang.org/frinkjar/functionnames.txt"
    
      16)
    
      17noextract=("${source[@]%%::*}")
    
      18sha256sums=(
    
      19	'SKIP'
    
      20	'SKIP'
    
      21	'SKIP'
    
      22)
    
      23
    
      24pkgver() {
    
      25	unzip -l "$srcdir/$pkgname.jar" | awk '/META-INF\/MANIFEST.MF/ { gsub("-",""); print $2 }';
    
      26}
    
      27
    
      28build() {
    
      29	unzip -p "$srcdir/$pkgname.jar" "data/icon.gif" > "$srcdir/$pkgname-icon.gif"
    
      30	convert "$srcdir/$pkgname-icon.gif" -interpolate Nearest -filter point -resize '512x512' "$srcdir/$pkgname-icon.png"
    
      31}
    
      32
    
      33package() {
    
      34
    
      35
    
      36	mkdir -p "$pkgdir/usr/share/java/frink/";
    
      37	cp "$srcdir/$pkgname.jar" "$pkgdir/usr/share/java/frink/frink.jar";
    
      38
    
      39	mkdir -p "$pkgdir/usr/share/frink/";
    
      40	cp "$srcdir/$pkgname-unitnames.txt" "$pkgdir/usr/share/frink/unitnames.txt";
    
      41	cp "$srcdir/$pkgname-functionnames.txt" "$pkgdir/usr/share/frink/functionnames.txt";
    
      42
    
      43	mkdir -p "$pkgdir/usr/bin/"
    
      44	cat > "$pkgdir/usr/bin/frink" << 'EOF'
    
      45#!/bin/bash
    
      46CP=/usr/share/java/frink/frink.jar
    
      47
    
      48rlwrap=$(command -v rlwrap)
    
      49rlwrap_args=""
    
      50if [ -n "${rlwrap}" ] 
    
      51then
    
      52	rlwrap_args="-f /usr/share/frink/unitnames.txt -b '$' -f /usr/share/frink/functionnames.txt"
    
      53fi
    
      54
    
      55java_opts=(
    
      56	"-Dawt.useSystemAAFontSettings=on"
    
      57	"-Dswing.aatext=true"
    
      58	"-Dswing.defaultlaf=com.sun.java.swing.plaf.gtk.GTKLookAndFeel"
    
      59	"-Dswing.crossplatformlaf=com.sun.java.swing.plaf.gtk.GTKLookAndFeel"
    
      60)
    
      61
    
      62exec $rlwrap $rlwrap_args /usr/bin/java ${java_opts[*]} -cp $CP frink.gui.FrinkStarter "$@"
    
      63EOF
    
      64	chmod a+x "$pkgdir/usr/bin/frink"
    
      65
    
      66	mkdir -p "$pkgdir/usr/share/icons/"
    
      67	cp "$srcdir/$pkgname-icon.png" "$pkgdir/usr/share/icons/frink.png"
    
      68
    
      69	mkdir -p "$pkgdir/usr/share/applications/"
    
      70	cat > "$pkgdir/usr/share/applications/frink.desktop" << 'EOF'
    
      71[Desktop Entry]
    
      72Type=Application
    
      73Version=1.0
    
      74Name=Frink
    
      75Comment=A practical calculating tool and programming language.
    
      76Exec=frink --gui
    
      77Icon=frink
    
      78Terminal=false
    
      79Categories=Utility;Science;Math;Calculator;Java
    
      80EOF
    
      81}
    
      82

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2