gprojector

maintainer deserts · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is the official NASA GISS server (giss.nasa.gov), which is the legitimate upstream vendor host for G.Projector. The dynamic SHA-1 retrieval at parse time is sloppy — it fetches the checksum over plain HTTP/HTTPS without a fixed expected value, so if the NASA server were compromised both the zip and its checksum would be replaced simultaneously, defeating the integrity check. However, this is a well-known limitation of fetching checksums from the same origin as the artifact, not an active attack or unofficial/personal host substitution. The source host is authoritative (NASA), the package installs Java JARs and a shell wrapper (no native compiled binaries from unofficial sources), and the pattern of fetching a vendor-provided SHA1 file is a common (if imperfect) practice. The risk is low: sloppy integrity verification from the same trusted vendor host, not a supply-chain substitution or code-execution concern from an unofficial host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The source is the official NASA GISS server (giss.nasa.gov), which is the legitimate upstream vendor host for G.Projector. The dynamic SHA-1 retrieval at parse time is sloppy — it fetches the checksum over plain HTTP/HTTPS without a fixed expected value, so if the NASA server were compromised both the zip and its checksum would be replaced simultaneously, defeating the integrity check. However, this is a well-known limitation of fetching checksums from the same origin as the artifact, not an active attack or unofficial/personal host substitution. The source host is authoritative (NASA), the package installs Java JARs and a shell wrapper (no native compiled binaries from unofficial sources), and the pattern of fetching a vendor-provided SHA1 file is a common (if imperfect) practice. The risk is low: sloppy integrity verification from the same trusted vendor host, not a supply-chain substitution or code-execution concern from an unofficial host.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:32 _sha1="$(curl https://www.giss.nasa.gov/tools/gprojector/download/G.Projector-${pkgver}.sha1.txt 2>/dev/null | grep "G.ProjectorJ.*.zip" | grep -o "^[^ ]*")"

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("https://www.giss.nasa.gov/tools/gprojector/download/G.ProjectorJ-${pkgver}.zip"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: deserts <int8@foxmail.com>
    
      2pkgname=gprojector
    
      3pkgver=3.1.0
    
      4pkgrel=1
    
      5pkgdesc="Interactive tool for exploring map projections"
    
      6arch=("any")
    
      7url="https://www.giss.nasa.gov/tools/gprojector/"
    
      8license=("custom")
    
      9groups=("nasa-tools")
    
      10depends=("java-runtime>=11"
    
      11         "hicolor-icon-theme"
    
      12         "desktop-file-utils")
    
      13makedepends=("unzip")
    
      14optdepends=()
    
      15provides=()
    
      16conflicts=()
    
      17replaces=()
    
      18backup=()
    
      19options=()
    
      20install=gprojector.install
    
      21changelog=
    
      22source=("https://www.giss.nasa.gov/tools/gprojector/download/G.ProjectorJ-${pkgver}.zip"
    
      23        "LICENSES"
    
      24        "gprojector-script.patch"
    
      25        "gprojector16.png"
    
      26        "gprojector32.png"
    
      27        "gprojector48.png"
    
      28        "gprojector64.png"
    
      29        "gprojector128.png"
    
      30        "gprojector.desktop")
    
      31noextract=()
    
      32_sha1="$(curl https://www.giss.nasa.gov/tools/gprojector/download/G.Projector-${pkgver}.sha1.txt 2>/dev/null | grep "G.ProjectorJ.*.zip" | grep -o "^[^ ]*")"
    
      33sha1sums=("${_sha1}"
    
      34          "01c11fd7393d5043e7444743cbbc343b1904c729"
    
      35          "35633c41c1c97ad6b708e2075637590dc5c401d7"
    
      36          "d33941fd5b6d9baab4af8a83539a599eff7046b3"
    
      37          "02089612edc7e9d1c3f616f6dc6c91df8cf33261"
    
      38          "6cbcd85a343a071f5713ac7646f269b88d8f0086"
    
      39          "e877f1f2a877fb7e146e32fe8684c61eba1ffd07"
    
      40          "52d228bc9e26c66521bf96c3468c22773786aeea"
    
      41          "33a7e21fc18b08222b0b44a007f4e6f788ba3cac")
    
      42
    
      43prepare() {
    
      44    cd ${srcdir}/G.ProjectorJ
    
      45    patch -uN -i ../gprojector-script.patch || return 1
    
      46    unzip -px jars/G.Projector.jar gov/nasa/giss/projector/about/resources/projector.png > ../gprojector244.png
    
      47}
    
      48
    
      49package() {
    
      50    install -Dm644 ${srcdir}/LICENSES ${pkgdir}/usr/share/licenses/${pkgname}/LICENSES
    
      51    install -d -m755 ${pkgdir}/usr/share/java/gprojector
    
      52    install -Dm644 ${srcdir}/G.ProjectorJ/jars/*.jar ${pkgdir}/usr/share/java/gprojector
    
      53    install -Dm755 ${srcdir}/G.ProjectorJ/gprojector.sh ${pkgdir}/usr/bin/gprojector
    
      54    install -Dm644 ${srcdir}/gprojector16.png ${pkgdir}/usr/share/icons/hicolor/16x16/apps/gprojector.png
    
      55    install -Dm644 ${srcdir}/gprojector32.png ${pkgdir}/usr/share/icons/hicolor/32x32/apps/gprojector.png
    
      56    install -Dm644 ${srcdir}/gprojector48.png ${pkgdir}/usr/share/icons/hicolor/48x48/apps/gprojector.png
    
      57    install -Dm644 ${srcdir}/gprojector64.png ${pkgdir}/usr/share/icons/hicolor/64x64/apps/gprojector.png
    
      58    install -Dm644 ${srcdir}/gprojector128.png ${pkgdir}/usr/share/icons/hicolor/128x128/apps/gprojector.png
    
      59    install -Dm644 ${srcdir}/gprojector244.png ${pkgdir}/usr/share/icons/hicolor/244x244/apps/gprojector.png
    
      60    install -Dm644 ${srcdir}/gprojector.desktop ${pkgdir}/usr/share/applications/gprojector.desktop
    
      61}
    
      62

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3