geotortue4-bin

maintainer Salamandar · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt JAR file from geotortue.free.fr, which is a free French hosting service (free.fr) rather than a dedicated project release infrastructure like GitHub releases or a project's own domain. The JAR is executed at runtime by the JVM, making it effectively executable code. The sha256sum provides integrity checking against tampering in transit, but does not protect against the upstream host serving a malicious file from the start. The host (geotortue.free.fr) appears to be the project's own website (the url= field matches the source host), which reduces but does not eliminate the concern — free.fr hosted sites can be taken over or compromised. The version mismatch between pkgver (3.14.02.19) and the JAR filename (4.17.11.04-beta) is sloppy but not a security issue. Overall this is a legitimate but non-ideal packaging pattern: a prebuilt binary JAR from a personal/free hosting service with a checksum, warranting medium concern rather than clean.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 'http://geotortue.free.fr/deploy/beta/geotortue-4.17.11.04-beta.jar'

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt JAR file from geotortue.free.fr, which is a free French hosting service (free.fr) rather than a dedicated project release infrastructure like GitHub releases or a project's own domain. The JAR is executed at runtime by the JVM, making it effectively executable code. The sha256sum provides integrity checking against tampering in transit, but does not protect against the upstream host serving a malicious file from the start. The host (geotortue.free.fr) appears to be the project's own website (the url= field matches the source host), which reduces but does not eliminate the concern — free.fr hosted sites can be taken over or compromised. The version mismatch between pkgver (3.14.02.19) and the JAR filename (4.17.11.04-beta) is sloppy but not a security issue. Overall this is a legitimate but non-ideal packaging pattern: a prebuilt binary JAR from a personal/free hosting service with a checksum, warranting medium concern rather than clean.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Salamandar <felix@piedallu.me>
    
      2
    
      3pkgname=geotortue4-bin
    
      4pkgver=3.14.02.19
    
      5pkgrel=1
    
      6pkgdesc='Programmation LOGO'
    
      7arch=('any')
    
      8url="http://geotortue.free.fr"
    
      9license=('GPLv3')
    
      10groups=('math')
    
      11depends=(
    
      12  geotortue-bin
    
      13  'jre8-openjdk'
    
      14)
    
      15source=(
    
      16    'http://geotortue.free.fr/deploy/beta/geotortue-4.17.11.04-beta.jar'
    
      17)
    
      18sha256sums=(
    
      19    '3e09b6460fa3f60694afdfac06f2c677dfc9910f4e9bbfc934f555218084423a'
    
      20)
    
      21
    
      22package() {
    
      23    install -d "${pkgdir}/usr/lib/"
    
      24    cp -r "/usr/lib/geotortue3" "${pkgdir}/usr/lib/geotortue4"
    
      25    rm "${pkgdir}/usr/lib/geotortue4/geotortue-3"*
    
      26    cp geotortue-4.17.11.04-beta.jar "${pkgdir}/usr/lib/geotortue4"
    
      27
    
      28    install -d "${pkgdir}/usr/share/applications/"
    
      29    cat "/usr/share/applications/geotortue.desktop" \
    
      30    | sed 's|Geotortue3|Geotortue4|;s|/usr/bin/geotortue|/usr/bin/geotortue4|' \
    
      31    > "${pkgdir}/usr/share/applications/geotortue4.desktop"
    
      32
    
      33    install -d "${pkgdir}/usr/bin"
    
      34    cat "/usr/bin/geotortue" \
    
      35    | sed 's|geotortue3/geotortue-3.*\.jar|geotortue4/geotortue-4.17.11.04-beta.jar|' \
    
      36    > "${pkgdir}/usr/bin/geotortue4"
    
      37    chmod +x "${pkgdir}/usr/bin/geotortue4"
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2