idos-timetable-data-chaps-trains-pid-2026-latest

maintainer dreieck · 0 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The package downloads timetable data files from the official project host for CHAPS idos, which is a legitimate source for the data; the files are not executable and are installed as static data, so even if the host were compromised, the worst case would be data tampering, not code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads timetable data files from the official project host for CHAPS idos, which is a legitimate source for the data; the files are not executable and are installed as static data, so even if the host were compromised, the worst case would be data tampering, not code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:71 "${_target}::https://ttakt.chaps.cz/TTAktual/Win/Zip/${_zipfile}"
  • PKGBUILD:72 "IDOS-Licence.pdf::https://chaps.cz/files/idos/IDOS-Licence.pdf"

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: dreieck
2
3# PKGBUILD last time manually edited: At least on 2025-12-10.
4
5_year='26'
6_prevyear="$(( ${_year} - 1 ))"
7url="https://chaps.cz/eng/download/idos/zip#kotvatt"
8_zipfile="VLAKPID${_year}.ZIP"
9_pkgver() {
10 # Reason for a _pkgver(): Have something to run before source download so that we can have version aware source downloads.
11 # Do not use metadata of the source file, but do website parsing: So we do not need to download the file to (AUR-)update the package version with our own crude hacked script 'idos-aur-update-versions.sh'.
12 #date -r "${srcdir}/${_target}" +"%Y_%m_%d"
13
14 wget -nv -O- "${url}" | tr -d '\a' | tr '\n' '\a' | sed 's|^.*File '"${_zipfile}"'\(.*\)Zip/'"${_zipfile}"'.*$|\1\n|g' | tr '\a' '\n' | grep 'Update date:' | cut -d, -f1 | sed -r 's|([0-9]+)\.([0-9]+)\.([0-9]+).|\n\3_\2_\1\n|g' | grep -E '^[0-9]+_[0-9]+_[0-9]+' | sed -E -e 's|_([0-9])_|_0\1_|g' -e 's|_([0-9])$|_0\1|g'
15}
16
17
18_pkgname="idos-timetable-data-chaps-trains-pid-20${_year}"
19pkgname="${_pkgname}-latest"
20epoch=0
21_pkgver="$(_pkgver)" # This should be set _before_ sources get downloaded.
22pkgver="${_pkgver}"
23pkgrel=1
24pkgdesc="20${_prevyear}/20${_year} Timetable data for the timetable search engines by CHAPS: Trains in Praha public transport reagion (PID)."
25arch=(any)
26license=('custom')
27
28groups=(
29 "idos-timetable"
30 )
31
32depends=(
33 "idos-timetable-data-trains-common"
34 )
35
36makedepends=(
37 "wget"
38)
39
40optdepends=(
41 "idos-timetable-tariff-mhd-pid: For showing prices."
42 "idos-timetable-maps-mhd-pid: For displaying routes on maps."
43 "idos-timetable-additionalinfo-mhd-pid: For additional information (photographs of some stops)."
44 )
45
46provides=(
47 "${_pkgname}=${pkgver}"
48
49 "idos-timetable-data=${pkgver}"
50 "idos-timetable-data-trains=${pkgver}"
51
52 "idos-timetable-data-trains-pid=${pkgver}"
53 "idos-timetable-data-trains-pid-20${_year}=${pkgver}"
54)
55
56replaces=(
57 "idos-timetable-data-chaps-trains-pid-20${_prevyear}"
58 "idos-timetable-data-chaps-trains-pid-20${_prevyear}-latest"
59)
60
61conflicts=(
62 "${_pkgname}"
63 'idos-timetable-data-trains-pid' # Conflicts via `/opt/idos-timetable/Data3/Vlak.ttr`.
64 ### The conflict will be handled by idos-timetable-data-chaps-all, if needed. Sometimes idos-timetable-data-chaps-all does not provide the train data, and then idos-timetable-data-chaps-all will depend on this package, thus this package should not have idos-timetable-data-chaps-all as conflict.
65 # "idos-timetable-data-chaps-all"
66)
67
68_target="vlakpid${_year}-${_pkgver}.zip"
69
70source=(
71 "${_target}::https://ttakt.chaps.cz/TTAktual/Win/Zip/${_zipfile}"
72 "IDOS-Licence.pdf::https://chaps.cz/files/idos/IDOS-Licence.pdf"
73 "license-dummy.txt"
74)
75
76sha256sums=(
77 'SKIP'
78 "SKIP"
79 "c6bb216055d3670d3100b7a74e04ce0644030f365f4349a09e630ef60fbcb9a4"
80)
81
82pkgver() {
83 printf '%s' "${_pkgver}"
84}
85
86
87package() {
88 _instdirbase='/opt/idos-timetable'
89 _instdir="${pkgdir}/${_instdirbase}"
90 install -d -m755 "${_instdir}"
91
92 cp -r "${srcdir}"/Data* "${_instdir}/"
93 chmod 755 "${_instdir}"/Data*
94 chmod 644 "${_instdir}"/Data*/*
95 rm -f "${_instdir}/Data1"/[vV][lL][aA][kK].[tT][tT][rR] # This one is provided by idos-timetable-data-trains-common.
96
97 install -d -m755 "${pkgdir}/usr/share/doc/${_pkgname}"
98 echo "${url}" > "${pkgdir}/usr/share/doc/${_pkgname}/info.url"
99 chmod 644 "${pkgdir}/usr/share/doc/${_pkgname}/info.url"
100
101 install -D -m644 "${srcdir}/license-dummy.txt" "${pkgdir}/usr/share/licenses/${pkgname}/copying.txt"
102 install -D -m644 "${srcdir}/IDOS-Licence.pdf" "${pkgdir}/usr/share/licenses/${pkgname}/IDOS-Licence.pdf"
103}
104

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2
2026-07-15 00:09:25 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion