geogebra-6-electron

LOW

maintainer Misaka13514 4 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a license file from geogebra.org during prepare(), which is from a non-whitelisted but official project domain; the main source is a portable Windows zip from the official download host, which is normal for repackaging, and no untrusted or obfuscated code execution occurs.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a license file from geogebra.org during prepare(), which is from a non-whitelisted but official project domain; the main source is a portable Windows zip from the official download host, which is normal for repackaging, and no untrusted or obfuscated code execution occurs.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:32 curl -sSfL -o "LICENSE.html" "https://www.geogebra.org/license"

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=(https://download.geogebra.org/installers/6.0/GeoGebra-Windows-Portable-${pkgver//./-}.zip

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Misaka13514 <Misaka13514 at gmail dot com>
    
      2# Contributor: Antonio Rojas <arojas@archlinux.org>
    
      3# Contributor: Evgeniy Alekseev <arcanis at archlinux dot org>
    
      4# Contributor: Bartłomiej Piotrowski <bpiotrowski at archlinux dot org>
    
      5# Contributor: Felipe Hommen <felibank at gmail dot com>
    
      6# Contributor: moostik <mooostik at gmail dot com>
    
      7
    
      8pkgname=geogebra-6-electron
    
      9pkgver=6.0.930.2
    
      10pkgrel=1
    
      11pkgdesc='Dynamic mathematics software with interactive graphics, algebra and spreadsheet'
    
      12arch=(any)
    
      13url='https://www.geogebra.org/'
    
      14license=(LicenseRef-GeoGebra)
    
      15depends=(electron)
    
      16makedepends=(curl)
    
      17provides=(geogebra)
    
      18conflicts=(geogebra geogebra-6-bin)
    
      19source=(https://download.geogebra.org/installers/6.0/GeoGebra-Windows-Portable-${pkgver//./-}.zip
    
      20        geogebra
    
      21        geogebra.svg
    
      22        geogebra.desktop
    
      23        geogebra-mime.xml)
    
      24sha256sums=('ada5e99eb6d7943b3ca3594d28047311e6fa60039fa28e04254f5ca087e6bf04'
    
      25            '62d6d48511ec9a3d08440d0bba7e6da35e61f84348729872941f66f2f8f15e57'
    
      26            'd81270ac2a7702246633fe11f448bd809e9250e2057077195eeabdc32b64ac46'
    
      27            'e8f3ac2c91daf1bb38ef4dddf705d341c3d8028aa4afb9b74a2d1a78a9953b98'
    
      28            '100dd83e61057b9a104630ea39a84d967475d459ab38e29783a7587b3acfb6a4')
    
      29
    
      30prepare() {
    
      31  # https://gitlab.archlinux.org/pacman/pacman-contrib/-/issues/119
    
      32  curl -sSfL -o "LICENSE.html" "https://www.geogebra.org/license"
    
      33}
    
      34
    
      35package() {
    
      36  cd $srcdir
    
      37
    
      38  install -Dm755 geogebra "$pkgdir"/usr/bin/geogebra
    
      39  install -dm755 "$pkgdir"/usr/lib/geogebra
    
      40  cp -dpr --no-preserve=ownership resources "$pkgdir"/usr/lib/geogebra
    
      41  cp -dpr --no-preserve=ownership locales "$pkgdir"/usr/lib/geogebra
    
      42
    
      43  install -Dm644 LICENSE.html -t "$pkgdir"/usr/share/licenses/$pkgname
    
      44  install -Dm644 geogebra.desktop -t "$pkgdir"/usr/share/applications/
    
      45  install -Dm644 geogebra.svg "$pkgdir"/usr/share/icons/hicolor/scalable/apps/geogebra.svg
    
      46  install -Dm644 geogebra-mime.xml "$pkgdir"/usr/share/mime/packages/geogebra.xml
    
      47}
    
      48

Changes since previous scan

--- PKGBUILD @ 2026-09-16 00:03
+++ PKGBUILD @ 2026-09-17 00:27
@@ -6,7 +6,7 @@
 # Contributor: moostik <mooostik at gmail dot com>
 
 pkgname=geogebra-6-electron
-pkgver=6.0.929.3
+pkgver=6.0.930.2
 pkgrel=1
 pkgdesc='Dynamic mathematics software with interactive graphics, algebra and spreadsheet'
 arch=(any)
@@ -21,7 +21,7 @@
         geogebra.svg
         geogebra.desktop
         geogebra-mime.xml)
-sha256sums=('a9b6d1b673ede8aebef8a232581a4c680fc3c22c7645de7b6b6cbdd24ae986c1'
+sha256sums=('ada5e99eb6d7943b3ca3594d28047311e6fa60039fa28e04254f5ca087e6bf04'
             '62d6d48511ec9a3d08440d0bba7e6da35e61f84348729872941f66f2f8f15e57'
             'd81270ac2a7702246633fe11f448bd809e9250e2057077195eeabdc32b64ac46'
             'e8f3ac2c91daf1bb38ef4dddf705d341c3d8028aa4afb9b74a2d1a78a9953b98'

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	3
2026-09-16 19:23:36	Medium	2
2026-09-16 00:03:17	Low	3
2026-09-15 00:25:31	Low	3
2026-09-14 00:27:57	Low	3
2026-09-13 00:19:54	Low	3
2026-09-12 00:25:17	Low	3
2026-09-11 00:19:22	Low	3
2026-09-10 00:22:44	Low	3
2026-09-09 00:04:09	Low	3
2026-09-08 00:18:08	Low	3
2026-09-07 00:30:15	Low	3
2026-09-06 00:17:06	Low	3
2026-09-05 00:16:27	Low	3
2026-09-04 00:03:13	Low	3
2026-09-03 00:15:47	Low	3
2026-09-02 00:02:31	Low	3
2026-09-01 00:11:19	Low	3
2026-08-31 00:19:57	Low	3
2026-08-30 00:04:14	Low	3