handle-client-bin

maintainer Ketchup901 · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged Downloads a tarball from handle.net (the official Handle.Net Registry domain) with a proper sha256 checksum; the package installs shell scripts and JARs from the project's own official distribution, which is normal AUR packaging with no obfuscation or exfiltration.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads a tarball from handle.net (the official Handle.Net Registry domain) with a proper sha256 checksum; the package installs shell scripts and JARs from the project's own official distribution, which is normal AUR packaging with no obfuscation or exfiltration.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://www.handle.net/hnr-source/handle-client-$pkgver-distribution.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ketchup901 <ketchup901@riseup.net>
    
      2
    
      3pkgname=handle-client-bin
    
      4pkgver=9.3.2
    
      5pkgrel=1
    
      6pkgdesc="HDL Client Library from the Handle.Net Registry"
    
      7arch=('any')
    
      8url="https://handle.net/client_download.html"
    
      9license=('custom:HNR-9-CL-Java-License AND Apache-2.0')
    
      10depends=('java-runtime>=8')
    
      11source=("https://www.handle.net/hnr-source/handle-client-$pkgver-distribution.tar.gz")
    
      12sha256sums=('1fb414d97bc9e1eebc5b39dcec0d1a03c373e84500b740f4d7e2d34f170d5cd2')
    
      13
    
      14package() {
    
      15    _srcdir=$srcdir/handle-client-$pkgver
    
      16    _binaries=$(find $_srcdir/bin/ -type f ! -name '*.bat' -printf '%f\n')
    
      17    install -d $pkgdir/opt/handle-client/bin/
    
      18    install -d $pkgdir/usr/bin/
    
      19    for _binary in $_binaries; do
    
      20        install $_srcdir/bin/$_binary -t $pkgdir/opt/handle-client/bin/
    
      21        ln -s "/opt/handle-client/bin/$_binary" "$pkgdir/usr/bin/$_binary"
    
      22    done
    
      23
    
      24    install -D $_srcdir/lib/* -t $pkgdir/opt/handle-client/lib/
    
      25
    
      26    install -d $pkgdir/opt/handle-client/doc/
    
      27    cp -R $_srcdir/doc/ $pkgdir/opt/handle-client/doc/
    
      28
    
      29
    
      30    install -Dm644 $_srcdir/LICENSE.txt -t $pkgdir/usr/share/licenses/$pkgname/
    
      31}
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	3
2026-08-17 00:18:29	LOW	3
2026-08-16 00:03:42	LOW	3
2026-08-15 00:26:13	LOW	3
2026-08-14 00:03:41	LOW	3
2026-08-13 00:17:07	LOW	3
2026-08-12 00:27:08	LOW	3
2026-08-11 13:35:39	LOW	3
2026-08-11 13:21:13	MEDIUM	2