idos-timetable-additionalinfo-chaps-mhd-odis-latest

maintainer dreieck · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a ZIP file and a PDF license from the project's official domain (chaps.cz and ttakt.chaps.cz), which are plausibly owned by the software vendor; the files are static data assets, not executable code, and are installed as-is; SKIP'd checksums are suboptimal but do not elevate risk given the context of data-only content from an official source.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a ZIP file and a PDF license from the project's official domain (chaps.cz and ttakt.chaps.cz), which are plausibly owned by the software vendor; the files are static data assets, not executable code, and are installed as-is; SKIP'd checksums are suboptimal but do not elevate risk given the context of data-only content from an official source.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:48 "${_target}::https://ttakt.chaps.cz/TTAktual/Win/Zip/${_zipfile}"
PKGBUILD:49 "IDOS-Licence.pdf::https://chaps.cz/files/idos/IDOS-Licence.pdf"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: dreieck
    
      2
    
      3# PKGBUILD last time manually edited: At least on 2023-09-04.
    
      4url="https://chaps.cz/eng/download/idos/zip#kotvainf"
    
      5_zipfile="CODIS.ZIP"
    
      6_pkgver() {
    
      7  # Reason for a _pkgver(): Have something to run before source download so that we can have version aware source downloads.
    
      8  wget -nv -O- "${url}" | tr -d '\a' | tr '\n' '\a' | sed  's|^.*File '"${_zipfile}"'\(.*\)Zip/'"${_zipfile}"'.*$|\1\n|g' | tr '\a' '\n' | grep 'Update date:' | cut -d, -f1 | sed -r 's|([0-9]+)\.([0-9]+)\.([0-9]+).|\n\3_\2_\1\n|g' | grep -E '^[0-9]+_[0-9]+_[0-9]+'
    
      9}
    
      10
    
      11_pkgname=idos-timetable-additionalinfo-chaps-mhd-odis
    
      12pkgname="${_pkgname}-latest"
    
      13epoch=0
    
      14_pkgver="$(_pkgver)" # This should be set _before_ sources get downloaded.
    
      15pkgver="${_pkgver}"
    
      16pkgrel=3
    
      17pkgdesc="Links with information on the changes, fare, point of sale, etc. for public transport within the ODIS (Ostrava region) public transport area, to be used with the timetable search engines by CHAPS."
    
      18arch=('any')
    
      19license=('custom')
    
      20
    
      21groups=(
    
      22        "idos-timetable"
    
      23       )
    
      24
    
      25depends=(
    
      26         "idos-timetable-data-mhd-odis"
    
      27        )
    
      28
    
      29makedepends=(
    
      30  "wget"
    
      31)
    
      32
    
      33optdepends=()
    
      34
    
      35provides=(
    
      36  "${_pkgname}=${pkgver}"
    
      37  
    
      38  "idos-timetable-additionalinfo-mhd-odis=${pkgver}"
    
      39)
    
      40
    
      41conflicts=(
    
      42  "${_pkgname}"
    
      43)
    
      44
    
      45_target="codis-${_pkgver}.zip"
    
      46
    
      47source=(
    
      48  "${_target}::https://ttakt.chaps.cz/TTAktual/Win/Zip/${_zipfile}"
    
      49  "IDOS-Licence.pdf::https://chaps.cz/files/idos/IDOS-Licence.pdf"
    
      50  "license-dummy.txt"
    
      51)
    
      52
    
      53sha256sums=(
    
      54  'SKIP'
    
      55  "SKIP"
    
      56  "c6bb216055d3670d3100b7a74e04ce0644030f365f4349a09e630ef60fbcb9a4"
    
      57)
    
      58
    
      59pkgver() {
    
      60  printf '%s' "${_pkgver}"
    
      61}
    
      62
    
      63
    
      64package() {
    
      65  _instdirbase='/opt/idos-timetable'
    
      66  _instdir="${pkgdir}/${_instdirbase}"
    
      67  install -d -m755 "${_instdir}"
    
      68
    
      69  cp -r "${srcdir}"/Data* "${_instdir}/"
    
      70  chmod 755 "${_instdir}"/Data*
    
      71  chmod 755 "${_instdir}"/Data*/*
    
      72  chmod 644 "${_instdir}"/Data*/*/*
    
      73
    
      74  install -d -m755 "${pkgdir}/usr/share/doc/${_pkgname}"
    
      75  echo "${url}" > "${pkgdir}/usr/share/doc/${_pkgname}/info.url"
    
      76  chmod 644 "${pkgdir}/usr/share/doc/${_pkgname}/info.url"
    
      77
    
      78  install -D -m644 "${srcdir}/license-dummy.txt" "${pkgdir}/usr/share/licenses/${pkgname}/copying.txt"
    
      79  install -D -m644 "${srcdir}/IDOS-Licence.pdf" "${pkgdir}/usr/share/licenses/${pkgname}/IDOS-Licence.pdf"
    
      80}
    
      81

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2