geogebra-6-electron

LOW

maintainer Misaka13514 5 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a license file from geogebra.org during prepare(), which is a non-whitelisted host but part of the official project; the main source is from download.geogebra.org, the project's own domain, making it a legitimate source for the software, and no unreviewed or executable remote code is run.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a license file from geogebra.org during prepare(), which is a non-whitelisted host but part of the official project; the main source is from download.geogebra.org, the project's own domain, making it a legitimate source for the software, and no unreviewed or executable remote code is run.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:32 curl -sSfL -o "LICENSE.html" "https://www.geogebra.org/license"

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=(https://download.geogebra.org/installers/6.0/GeoGebra-Windows-Portable-${pkgver//./-}.zip

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Misaka13514 <Misaka13514 at gmail dot com>
    
      2# Contributor: Antonio Rojas <arojas@archlinux.org>
    
      3# Contributor: Evgeniy Alekseev <arcanis at archlinux dot org>
    
      4# Contributor: Bartłomiej Piotrowski <bpiotrowski at archlinux dot org>
    
      5# Contributor: Felipe Hommen <felibank at gmail dot com>
    
      6# Contributor: moostik <mooostik at gmail dot com>
    
      7
    
      8pkgname=geogebra-6-electron
    
      9pkgver=6.0.934.0
    
      10pkgrel=1
    
      11pkgdesc='Dynamic mathematics software with interactive graphics, algebra and spreadsheet'
    
      12arch=(any)
    
      13url='https://www.geogebra.org/'
    
      14license=(LicenseRef-GeoGebra)
    
      15depends=(electron)
    
      16makedepends=(curl)
    
      17provides=(geogebra)
    
      18conflicts=(geogebra geogebra-6-bin)
    
      19source=(https://download.geogebra.org/installers/6.0/GeoGebra-Windows-Portable-${pkgver//./-}.zip
    
      20        geogebra
    
      21        geogebra.svg
    
      22        geogebra.desktop
    
      23        geogebra-mime.xml)
    
      24sha256sums=('0e978d53958246a984bd061c47e5b1e31ca8ed5de8c748129bf1b79289291eaa'
    
      25            '62d6d48511ec9a3d08440d0bba7e6da35e61f84348729872941f66f2f8f15e57'
    
      26            'd81270ac2a7702246633fe11f448bd809e9250e2057077195eeabdc32b64ac46'
    
      27            'e8f3ac2c91daf1bb38ef4dddf705d341c3d8028aa4afb9b74a2d1a78a9953b98'
    
      28            '100dd83e61057b9a104630ea39a84d967475d459ab38e29783a7587b3acfb6a4')
    
      29
    
      30prepare() {
    
      31  # https://gitlab.archlinux.org/pacman/pacman-contrib/-/issues/119
    
      32  curl -sSfL -o "LICENSE.html" "https://www.geogebra.org/license"
    
      33}
    
      34
    
      35package() {
    
      36  cd $srcdir
    
      37
    
      38  install -Dm755 geogebra "$pkgdir"/usr/bin/geogebra
    
      39  install -dm755 "$pkgdir"/usr/lib/geogebra
    
      40  cp -dpr --no-preserve=ownership resources "$pkgdir"/usr/lib/geogebra
    
      41  cp -dpr --no-preserve=ownership locales "$pkgdir"/usr/lib/geogebra
    
      42
    
      43  install -Dm644 LICENSE.html -t "$pkgdir"/usr/share/licenses/$pkgname
    
      44  install -Dm644 geogebra.desktop -t "$pkgdir"/usr/share/applications/
    
      45  install -Dm644 geogebra.svg "$pkgdir"/usr/share/icons/hicolor/scalable/apps/geogebra.svg
    
      46  install -Dm644 geogebra-mime.xml "$pkgdir"/usr/share/mime/packages/geogebra.xml
    
      47}
    
      48

Changes since previous scan

--- PKGBUILD @ 2026-10-28 00:06
+++ PKGBUILD @ 2026-11-01 00:21
@@ -6,7 +6,7 @@
 # Contributor: moostik <mooostik at gmail dot com>
 
 pkgname=geogebra-6-electron
-pkgver=6.0.933.1
+pkgver=6.0.934.0
 pkgrel=1
 pkgdesc='Dynamic mathematics software with interactive graphics, algebra and spreadsheet'
 arch=(any)
@@ -21,7 +21,7 @@
         geogebra.svg
         geogebra.desktop
         geogebra-mime.xml)
-sha256sums=('318124ef03249ea2397f4b14f10b452a18642825ea796f0980dba0697d816c98'
+sha256sums=('0e978d53958246a984bd061c47e5b1e31ca8ed5de8c748129bf1b79289291eaa'
             '62d6d48511ec9a3d08440d0bba7e6da35e61f84348729872941f66f2f8f15e57'
             'd81270ac2a7702246633fe11f448bd809e9250e2057077195eeabdc32b64ac46'
             'e8f3ac2c91daf1bb38ef4dddf705d341c3d8028aa4afb9b74a2d1a78a9953b98'

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	3
2026-10-31 00:07:41	Low	3
2026-10-30 00:29:30	Low	3
2026-10-29 00:13:55	Low	3
2026-10-28 21:50:44	Medium	2
2026-10-28 00:06:54	Medium	3
2026-10-27 00:23:28	Medium	3
2026-10-26 00:12:40	Medium	3
2026-10-25 00:20:48	Medium	3
2026-10-24 00:14:55	Medium	3
2026-10-23 00:02:19	Medium	3
2026-10-22 00:13:10	Medium	3
2026-10-21 00:12:50	Medium	3
2026-10-20 00:10:31	Medium	3
2026-10-19 21:26:37	Medium	3
2026-10-19 00:03:55	Medium	3
2026-10-18 00:06:55	Medium	3
2026-10-17 00:21:55	Medium	3
2026-10-16 00:12:47	Medium	3
2026-10-15 00:28:05	Medium	3