igv

maintainer balwierz · 15 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt zip from the Broad Institute's official data domain, which is the project's legitimate source;虽 host not whitelisted,但 source is verifiable and contains only data and binaries from the official project, with no code execution or exfiltration risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt zip from the Broad Institute's official data domain, which is the project's legitimate source;虽 host not whitelisted,但 source is verifiable and contains only data and binaries from the official project, with no code execution or exfiltration risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("https://data.broadinstitute.org/igv/projects/downloads/${minor_pkgver}/IGV_Linux_${pkgver}_WithJava.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Decrypted Epsilon <decrypted.epsilon@gmail.com>
    
      2# Contributor: Stefan Husmann <stefan-husmann@t-online.de>
    
      3# Maintainer:  Piotr Balwierz <parseByHuman(surname at email_service_of_google)>
    
      4# Co-maintainer: Rhinoceros <https://aur.archlinux.org/account/rhinoceros>
    
      5
    
      6pkgname=igv
    
      7pkgver=2.19.7
    
      8_github_pkgver=$pkgver
    
      9#_github_pkgver=2.19.6
    
      10minor_pkgver=$(<<<$pkgver sed -E 's/^([0-9]+\.[0-9]+)\..*/\1/')
    
      11_pkgver=${pkgver//_/-}   # currently not needed
    
      12pkgrel=1
    
      13pkgdesc="High-performance visualization tool for interactive exploration of large, integrated genomic datasets. From Broad Institute."
    
      14arch=('any')
    
      15url="http://www.broadinstitute.org/software/igv/home"
    
      16license=('MIT')
    
      17depends=('jre21-openjdk' 'archlinux-java-run' 'sh')
    
      18#"igv-$pkgver.tar.gz::https://github.com/igvteam/igv/archive/v$pkgver.tar.gz"
    
      19source=("https://data.broadinstitute.org/igv/projects/downloads/${minor_pkgver}/IGV_Linux_${pkgver}_WithJava.zip"
    
      20        "$pkgname.sh"
    
      21        "igv_hidpi.sh"
    
      22        "$pkgname.desktop"
    
      23        "igv_hidpi.desktop"
    
      24        "${pkgname}-license-2023.txt::https://raw.githubusercontent.com/igvteam/igv/v${_github_pkgver}/license.txt"
    
      25        "https://raw.githubusercontent.com/igvteam/igv/v${_github_pkgver}/docs/web/IGV_64.png")
    
      26sha512sums=('9e89c36c17ac310d7c0f9747f8b1c7c1d3c67272a66a45bb0ad18a6c16d5b301a36b32dd57eabbb03d8ac92c69ae644d97bee152ec7f77f1b8c1e0c6a1aafa2d'
    
      27            'b382236f58035cee2ab24eaddcc4ace9d230a6378114b9ef23f84f347586547d5e759709aa9e1a4ed0421c76778af7d88b7637f47cc8cfc7c7bb5dcf9d244986'
    
      28            '47fad83e195055bebedfedf13d5d9e3a621dc162e41bc4e4c6cfdbfce204abc87f25577ec70c02fc9b4fb0ce785017d826071b32de1a0dcc43d6ef5cb459f4d5'
    
      29            '668b6dc6621415298af2b1b57c7bc4cca5be5fd45c189d14bc90cb0e5d992b53eda806a058d1920b96451c0f441b8670931fad0382c4568498b9ba6e81f5d263'
    
      30            'ff9ec7e172ed69ff6a7cb6ebca7baf702fde4f702e59bc8cab6acbeb5e6cdf1884ec1fc53ec3ba0ca4960807f79edc5f0370c2780e3a6325b6faa61326a05533'
    
      31            'ae986e63acc2d62af17315c3b3abcd54897bf418dd42b7c90a06d0e89550f4eebc887ed63be04f8880fe193f01bb12909306046b34e74905c125b8f0594937d4'
    
      32            '42a3924c7022fab7ed3598fe5a8524127a7386fb9bf6d71e90f1e85e0087b551797806b0c24679ce8fa24b6a448f55942f934e438bd18623d76711571affa296')
    
      33
    
      34package() {
    
      35  install -Dm755 $pkgname.sh "$pkgdir"/usr/bin/$pkgname
    
      36  install -Dm755 "$pkgname"_hidpi.sh "$pkgdir"/usr/bin/"$pkgname"_hidpi
    
      37  install -Dm644 $pkgname.desktop "$pkgdir"/usr/share/applications/$pkgname.desktop
    
      38  install -Dm644 "$pkgname"_hidpi.desktop "$pkgdir"/usr/share/applications/"$pkgname"_hidpi.desktop
    
      39  install -Dm644 ${pkgname}-license-2023.txt "${pkgdir}/usr/share/licenses/${pkgname}/license.txt"
    
      40  install -Dm644 IGV_64.png "$pkgdir"/usr/share/pixmaps/$pkgname.png
    
      41  cd IGV_Linux_${_pkgver}
    
      42  install -Dm644 igv.args "$pkgdir"/usr/share/java/$pkgname/igv.args
    
      43  install -Dm644 lib/* -t "$pkgdir"/usr/share/java/$pkgname/lib/
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2