geogebra-html

maintainer evine · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a source archive from a plausible official GeoGebra download host, builds only static HTML files, and installs them as data; the non-whitelisted host is the project's own domain, and the content is non-executable, so the risk is low despite the unverifiable checksum.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source archive from a plausible official GeoGebra download host, builds only static HTML files, and installs them as data; the non-whitelisted host is the project's own domain, and the content is non-executable, so the risk is low despite the unverifiable checksum.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("${_pkgname}-${pkgver}.zip::https://download.geogebra.org/installers/${pkgver%.*.*}/geogebra-math-apps-bundle-${pkgver//./-}.zip")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: devome <evinedeng@hotmail.com>
    
      2
    
      3_pkgname=geogebra
    
      4pkgname="${_pkgname}-html"
    
      5pkgver=5.4.927.1
    
      6pkgrel=1
    
      7pkgdesc="Dynamic mathematics software with interactive graphics, algebra and spreadsheet (HTML files only)"
    
      8arch=("any")
    
      9url="https://www.geogebra.org"
    
      10license=("LicenseRef-GeoGebra:${url}/license")
    
      11optdepends=("caddy: for serving ${_pkgname} HTML files"
    
      12            "nginx: for serving ${_pkgname} HTML files"
    
      13            "traefik: for serving ${_pkgname} HTML files")
    
      14source=("${_pkgname}-${pkgver}.zip::https://download.geogebra.org/installers/${pkgver%.*.*}/geogebra-math-apps-bundle-${pkgver//./-}.zip")
    
      15sha256sums=('a8b76bbbcda83db60ad76c38d988673928cf1f62fda1bc4b83666f77dba17a3c')
    
      16
    
      17package() {
    
      18    cd GeoGebra/HTML5/5.0
    
      19    find . -type f -exec install -Dm644 {} "${pkgdir}/usr/share/webapps/${pkgname}/{}" \;
    
      20    ln -sf GeoGebra.html "${pkgdir}/usr/share/webapps/${pkgname}/index.html"
    
      21}
    
      22

Changes since previous scan

--- PKGBUILD @ 2026-07-16 01:51
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,7 +2,7 @@
 
 _pkgname=geogebra
 pkgname="${_pkgname}-html"
-pkgver=5.4.925.3
+pkgver=5.4.927.1
 pkgrel=1
 pkgdesc="Dynamic mathematics software with interactive graphics, algebra and spreadsheet (HTML files only)"
 arch=("any")
@@ -12,7 +12,7 @@
             "nginx: for serving ${_pkgname} HTML files"
             "traefik: for serving ${_pkgname} HTML files")
 source=("${_pkgname}-${pkgver}.zip::https://download.geogebra.org/installers/${pkgver%.*.*}/geogebra-math-apps-bundle-${pkgver//./-}.zip")
-sha256sums=('e4daa512834f6d3cf8c64a6fe28ced8dd4d2d25e687b3d8928c78d03c5f770b6')
+sha256sums=('a8b76bbbcda83db60ad76c38d988673928cf1f62fda1bc4b83666f77dba17a3c')
 
 package() {
     cd GeoGebra/HTML5/5.0

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 11:35:00	MEDIUM	2
2026-07-16 01:51:59	CLEAN	3
2026-07-16 01:50:03	MEDIUM	2