idos-timetable-data-chaps-trains-pid-2026-latest
maintainer dreieck
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads timetable data files from the official project host for CHAPS idos, which is a legitimate source for the data; the files are not executable and are installed as static data, so even if the host were compromised, the worst case would be data tampering, not code execution.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads timetable data files from the official project host for CHAPS idos, which is a legitimate source for the data; the files are not executable and are installed as static data, so even if the host were compromised, the worst case would be data tampering, not code execution.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:71
"${_target}::https://ttakt.chaps.cz/TTAktual/Win/Zip/${_zipfile}" -
PKGBUILD:72
"IDOS-Licence.pdf::https://chaps.cz/files/idos/IDOS-Licence.pdf"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: dreieck
2
3
# PKGBUILD last time manually edited: At least on 2025-12-10.
4
5
_year='26'
6
_prevyear="$(( ${_year} - 1 ))"
7
url="https://chaps.cz/eng/download/idos/zip#kotvatt"
8
_zipfile="VLAKPID${_year}.ZIP"
9
_pkgver() {
10
# Reason for a _pkgver(): Have something to run before source download so that we can have version aware source downloads.
11
# Do not use metadata of the source file, but do website parsing: So we do not need to download the file to (AUR-)update the package version with our own crude hacked script 'idos-aur-update-versions.sh'.
12
#date -r "${srcdir}/${_target}" +"%Y_%m_%d"
13
14
wget -nv -O- "${url}" | tr -d '\a' | tr '\n' '\a' | sed 's|^.*File '"${_zipfile}"'\(.*\)Zip/'"${_zipfile}"'.*$|\1\n|g' | tr '\a' '\n' | grep 'Update date:' | cut -d, -f1 | sed -r 's|([0-9]+)\.([0-9]+)\.([0-9]+).|\n\3_\2_\1\n|g' | grep -E '^[0-9]+_[0-9]+_[0-9]+' | sed -E -e 's|_([0-9])_|_0\1_|g' -e 's|_([0-9])$|_0\1|g'
15
}
16
17
18
_pkgname="idos-timetable-data-chaps-trains-pid-20${_year}"
19
pkgname="${_pkgname}-latest"
20
epoch=0
21
_pkgver="$(_pkgver)" # This should be set _before_ sources get downloaded.
22
pkgver="${_pkgver}"
23
pkgrel=1
24
pkgdesc="20${_prevyear}/20${_year} Timetable data for the timetable search engines by CHAPS: Trains in Praha public transport reagion (PID)."
25
arch=(any)
26
license=('custom')
27
28
groups=(
29
"idos-timetable"
30
)
31
32
depends=(
33
"idos-timetable-data-trains-common"
34
)
35
36
makedepends=(
37
"wget"
38
)
39
40
optdepends=(
41
"idos-timetable-tariff-mhd-pid: For showing prices."
42
"idos-timetable-maps-mhd-pid: For displaying routes on maps."
43
"idos-timetable-additionalinfo-mhd-pid: For additional information (photographs of some stops)."
44
)
45
46
provides=(
47
"${_pkgname}=${pkgver}"
48
49
"idos-timetable-data=${pkgver}"
50
"idos-timetable-data-trains=${pkgver}"
51
52
"idos-timetable-data-trains-pid=${pkgver}"
53
"idos-timetable-data-trains-pid-20${_year}=${pkgver}"
54
)
55
56
replaces=(
57
"idos-timetable-data-chaps-trains-pid-20${_prevyear}"
58
"idos-timetable-data-chaps-trains-pid-20${_prevyear}-latest"
59
)
60
61
conflicts=(
62
"${_pkgname}"
63
'idos-timetable-data-trains-pid' # Conflicts via `/opt/idos-timetable/Data3/Vlak.ttr`.
64
### The conflict will be handled by idos-timetable-data-chaps-all, if needed. Sometimes idos-timetable-data-chaps-all does not provide the train data, and then idos-timetable-data-chaps-all will depend on this package, thus this package should not have idos-timetable-data-chaps-all as conflict.
65
# "idos-timetable-data-chaps-all"
66
)
67
68
_target="vlakpid${_year}-${_pkgver}.zip"
69
70
source=(
71
"${_target}::https://ttakt.chaps.cz/TTAktual/Win/Zip/${_zipfile}"
72
"IDOS-Licence.pdf::https://chaps.cz/files/idos/IDOS-Licence.pdf"
73
"license-dummy.txt"
74
)
75
76
sha256sums=(
77
'SKIP'
78
"SKIP"
79
"c6bb216055d3670d3100b7a74e04ce0644030f365f4349a09e630ef60fbcb9a4"
80
)
81
82
pkgver() {
83
printf '%s' "${_pkgver}"
84
}
85
86
87
package() {
88
_instdirbase='/opt/idos-timetable'
89
_instdir="${pkgdir}/${_instdirbase}"
90
install -d -m755 "${_instdir}"
91
92
cp -r "${srcdir}"/Data* "${_instdir}/"
93
chmod 755 "${_instdir}"/Data*
94
chmod 644 "${_instdir}"/Data*/*
95
rm -f "${_instdir}/Data1"/[vV][lL][aA][kK].[tT][tT][rR] # This one is provided by idos-timetable-data-trains-common.
96
97
install -d -m755 "${pkgdir}/usr/share/doc/${_pkgname}"
98
echo "${url}" > "${pkgdir}/usr/share/doc/${_pkgname}/info.url"
99
chmod 644 "${pkgdir}/usr/share/doc/${_pkgname}/info.url"
100
101
install -D -m644 "${srcdir}/license-dummy.txt" "${pkgdir}/usr/share/licenses/${pkgname}/copying.txt"
102
install -D -m644 "${srcdir}/IDOS-Licence.pdf" "${pkgdir}/usr/share/licenses/${pkgname}/IDOS-Licence.pdf"
103
}
104
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |