geogebra-6-electron

maintainer Misaka13514 · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a license file from geogebra.org during prepare(), which is from a non-whitelisted but official and plausible project host; the main source is a GeoGebra official installer zip, and no untrusted or obfuscated code execution occurs.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a license file from geogebra.org during prepare(), which is from a non-whitelisted but official and plausible project host; the main source is a GeoGebra official installer zip, and no untrusted or obfuscated code execution occurs.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:32 curl -sSfL -o "LICENSE.html" "https://www.geogebra.org/license"

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=(https://download.geogebra.org/installers/6.0/GeoGebra-Windows-Portable-${pkgver//./-}.zip

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Misaka13514 <Misaka13514 at gmail dot com>
    
      2# Contributor: Antonio Rojas <arojas@archlinux.org>
    
      3# Contributor: Evgeniy Alekseev <arcanis at archlinux dot org>
    
      4# Contributor: Bartłomiej Piotrowski <bpiotrowski at archlinux dot org>
    
      5# Contributor: Felipe Hommen <felibank at gmail dot com>
    
      6# Contributor: moostik <mooostik at gmail dot com>
    
      7
    
      8pkgname=geogebra-6-electron
    
      9pkgver=6.0.927.1
    
      10pkgrel=1
    
      11pkgdesc='Dynamic mathematics software with interactive graphics, algebra and spreadsheet'
    
      12arch=(any)
    
      13url='https://www.geogebra.org/'
    
      14license=(LicenseRef-GeoGebra)
    
      15depends=(electron)
    
      16makedepends=(curl)
    
      17provides=(geogebra)
    
      18conflicts=(geogebra geogebra-6-bin)
    
      19source=(https://download.geogebra.org/installers/6.0/GeoGebra-Windows-Portable-${pkgver//./-}.zip
    
      20        geogebra
    
      21        geogebra.svg
    
      22        geogebra.desktop
    
      23        geogebra-mime.xml)
    
      24sha256sums=('6bf7fec4a55edef774bcb13cc4391e793e000e32f358d75eb2aee287b4f3baed'
    
      25            '62d6d48511ec9a3d08440d0bba7e6da35e61f84348729872941f66f2f8f15e57'
    
      26            'd81270ac2a7702246633fe11f448bd809e9250e2057077195eeabdc32b64ac46'
    
      27            'e8f3ac2c91daf1bb38ef4dddf705d341c3d8028aa4afb9b74a2d1a78a9953b98'
    
      28            '100dd83e61057b9a104630ea39a84d967475d459ab38e29783a7587b3acfb6a4')
    
      29
    
      30prepare() {
    
      31  # https://gitlab.archlinux.org/pacman/pacman-contrib/-/issues/119
    
      32  curl -sSfL -o "LICENSE.html" "https://www.geogebra.org/license"
    
      33}
    
      34
    
      35package() {
    
      36  cd $srcdir
    
      37
    
      38  install -Dm755 geogebra "$pkgdir"/usr/bin/geogebra
    
      39  install -dm755 "$pkgdir"/usr/lib/geogebra
    
      40  cp -dpr --no-preserve=ownership resources "$pkgdir"/usr/lib/geogebra
    
      41  cp -dpr --no-preserve=ownership locales "$pkgdir"/usr/lib/geogebra
    
      42
    
      43  install -Dm644 LICENSE.html -t "$pkgdir"/usr/share/licenses/$pkgname
    
      44  install -Dm644 geogebra.desktop -t "$pkgdir"/usr/share/applications/
    
      45  install -Dm644 geogebra.svg "$pkgdir"/usr/share/icons/hicolor/scalable/apps/geogebra.svg
    
      46  install -Dm644 geogebra-mime.xml "$pkgdir"/usr/share/mime/packages/geogebra.xml
    
      47}
    
      48

Changes since previous scan

--- PKGBUILD @ 2026-07-29 00:25
+++ PKGBUILD @ 2026-08-03 00:08
@@ -6,7 +6,7 @@
 # Contributor: moostik <mooostik at gmail dot com>
 
 pkgname=geogebra-6-electron
-pkgver=6.0.920.0
+pkgver=6.0.927.1
 pkgrel=1
 pkgdesc='Dynamic mathematics software with interactive graphics, algebra and spreadsheet'
 arch=(any)
@@ -21,7 +21,7 @@
         geogebra.svg
         geogebra.desktop
         geogebra-mime.xml)
-sha256sums=('9533610cff7af09e71cdd73e574d6206e5607339a2fb5d0dc9893056ce027198'
+sha256sums=('6bf7fec4a55edef774bcb13cc4391e793e000e32f358d75eb2aee287b4f3baed'
             '62d6d48511ec9a3d08440d0bba7e6da35e61f84348729872941f66f2f8f15e57'
             'd81270ac2a7702246633fe11f448bd809e9250e2057077195eeabdc32b64ac46'
             'e8f3ac2c91daf1bb38ef4dddf705d341c3d8028aa4afb9b74a2d1a78a9953b98'

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 23:13:22	MEDIUM	2
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3