gplates-bin

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The PKGBUILD downloads a .deb from earthbyte.org (the official GPlates distribution site run by the EarthByte group at University of Sydney) and also downloads the pkg2appimage script from the official AppImage GitHub repository. Both sources have MD5 checksums provided (not SKIP'd as the cheaper model claimed). The earthbyte.org host is the legitimate upstream distribution channel for GPlates scientific software. The build process converts the .deb into an AppImage using the official pkg2appimage tool. While MD5 is a weak hash algorithm and the host is not a major distro mirror, this is not a supply-chain concern beyond normal AUR risk — the checksums are present, the sources are legitimate upstream locations, and the software is well-known scientific software. The pattern is sloppy (MD5 instead of SHA256, AppImage packaging) but not a genuine security risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The PKGBUILD downloads a .deb from earthbyte.org (the official GPlates distribution site run by the EarthByte group at University of Sydney) and also downloads the pkg2appimage script from the official AppImage GitHub repository. Both sources have MD5 checksums provided (not SKIP'd as the cheaper model claimed). The earthbyte.org host is the legitimate upstream distribution channel for GPlates scientific software. The build process converts the .deb into an AppImage using the official pkg2appimage tool. While MD5 is a weak hash algorithm and the host is not a major distro mirror, this is not a supply-chain concern beyond normal AUR risk — the checksums are present, the sources are legitimate upstream locations, and the software is well-known scientific software. The pattern is sloppy (MD5 instead of SHA256, AppImage packaging) but not a genuine security risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 gplates_2.3.0_ubuntu-20.04-amd64.deb::https://www.earthbyte.org/download/8430

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Tim Clifford <tim at clifford dot lol>
    
      2
    
      3pkgname=gplates-bin
    
      4pkgver=2.3
    
      5pkgrel=1
    
      6pkgdesc="GPlates - a plate tectonics program. Built as an AppImage from the .deb"
    
      7arch=('x86_64')
    
      8url="https://www.gplates.org"
    
      9license=('GPL2')
    
      10makedepends=('dpkg' 'imagemagick' 'wget' 'desktop-file-utils')
    
      11options=(!strip) # necessary otherwise the AppImage file in the package is truncated
    
      12source=(
    
      13  gplates.sh
    
      14  gplates-appimage.yml
    
      15  gplates.png
    
      16  https://raw.githubusercontent.com/AppImage/pkg2appimage/master/pkg2appimage
    
      17  gplates_2.3.0_ubuntu-20.04-amd64.deb::https://www.earthbyte.org/download/8430
    
      18)
    
      19md5sums=(
    
      20  5f40760e7d3448a413354bbdcb72e529
    
      21  6a85bf12313cd662f7cd23a05f978ca2
    
      22  4476faf94d5d8c919aeaa34aa0b2ed04
    
      23  29b5588e48f5705029ab3e954d16e40b
    
      24  871ab30b353286f2e812ee22667ebb83
    
      25)
    
      26
    
      27build() {
    
      28	# put deb and icon in place
    
      29	mkdir -p gplates
    
      30	ln -sf $(realpath *.deb) gplates/
    
      31	cp $(realpath gplates.png) gplates/
    
      32
    
      33	# create appimage
    
      34	_SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH
    
      35	unset SOURCE_DATE_EPOCH
    
      36	bash -ex ./pkg2appimage gplates-appimage.yml
    
      37	SOURCE_DATE_EPOCH=$_SOURCE_DATE_EPOCH
    
      38}
    
      39
    
      40package() {
    
      41	ls -l out
    
      42	INSTALL_PATH="/opt/appimages/gplates.AppImage"
    
      43
    
      44	# install icons
    
      45	install -Dm644 "gplates.png" "$pkgdir/usr/share/icons/hicolor/256x256/apps/gplates.png"
    
      46
    
      47	# install image file and desktop file
    
      48	install -Dm755 ./out/*.AppImage "$pkgdir/opt/appimages/gplates.AppImage"
    
      49	install -Dm644 "gplates/gplates.AppDir/gplates.desktop" \
    
      50		"$pkgdir/usr/share/applications/gplates.desktop"
    
      51
    
      52	# install wrapper in /usr/bin
    
      53	install -Dm755 "gplates.sh" "$pkgdir/usr/bin/gplates"
    
      54
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2