irpf-2018

maintainer paulequilibrio · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source URL is hosted on a government domain (receita.fazenda.gov.br) which is plausibly the official release infrastructure for the IRPF software; the download is a versioned zip file containing static assets and JAR files, typical for this type of application, and there is no evidence of remote code execution or obfuscation.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source URL is hosted on a government domain (receita.fazenda.gov.br) which is plausibly the official release infrastructure for the IRPF software; the download is a versioned zip file containing static assets and JAR files, typical for this type of application, and there is no evidence of remote code execution or obfuscation.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 "https://downloadirpf.receita.fazenda.gov.br/irpf/${YEAR}/irpf/arquivos/${NAME}${YEAR}-${pkgver}.zip"

PKGBUILD

1 offending line(s) highlighted

      1#!/usr/bin/env bash
    
      2
    
      3# Maintainer: Paulo Alexandre <paulequilibrio at gmail dot com>
    
      4
    
      5# This package was inspired from https://aur.archlinux.org/packages/irpf by
    
      6# Contributor: Márcio Sousa Rocha <marciosr10 at gmail dot com>
    
      7
    
      8# shellcheck disable=SC2154,SC2034
    
      9NAME=IRPF
    
      10YEAR=2018
    
      11pkgname="irpf-${YEAR}"
    
      12pkgver=1.7
    
      13pkgrel=1
    
      14license=('custom')
    
      15arch=(any)
    
      16pkgdesc="Programa Gerador de Declaração (PGD) da Declaração do Imposto sobre a Renda das Pessoas Físicas (DIRPF) $YEAR"
    
      17url='https://www.gov.br/receitafederal/pt-br'
    
      18source=(
    
      19  "https://downloadirpf.receita.fazenda.gov.br/irpf/${YEAR}/irpf/arquivos/${NAME}${YEAR}-${pkgver}.zip"
    
      20  'copyright'
    
      21  "$pkgname"
    
      22  "$pkgname.desktop"
    
      23  "$pkgname.png"
    
      24)
    
      25md5sums=('7e0eec8fcc34d90d9e7888b7ccaef4ed'
    
      26         '7b4f64fbc5f95c918c2f9db09c908603'
    
      27         '29ba102b96c052b655ed70b6723d45af'
    
      28         '4e5cb890abf125a7743091bee69fa4ab'
    
      29         '43d8c9617118578f03b2c4eeb1c72c57')
    
      30 
    
      31depends=('java-runtime' 'hicolor-icon-theme' 'sh')
    
      32 
    
      33package() {
    
      34  mkdir -p "$pkgdir"/usr/share/{icons/hicolor/128x128/apps,applications,licenses/"$NAME"/"$pkgname","$NAME"/"$pkgname"}
    
      35  mkdir "${pkgdir}/usr/bin"
    
      36  local BASEDIR="${pkgdir}/usr/share/${NAME}/${pkgname}"
    
      37
    
      38  cd "${srcdir}/${NAME}${YEAR}" || exit
    
      39  cp -rf help "$BASEDIR/"
    
      40  cp -rf lib "$BASEDIR/"
    
      41  cp -rf tutorial "$BASEDIR/"
    
      42
    
      43  install -Dm755 irpf.jar "$BASEDIR/${pkgname}.jar"
    
      44  install -Dm644 IRPF${YEAR}.acb "$BASEDIR/"
    
      45  install -Dm644 IRPF${YEAR}.ini "$BASEDIR/"
    
      46  install -Dm644 Leia-me.htm "$BASEDIR/"
    
      47  install -Dm644 offline.png "$BASEDIR/"
    
      48  install -Dm644 online.png "$BASEDIR/"
    
      49  install -Dm644 pgd-updater.jar "$BASEDIR/"
    
      50
    
      51  install -Dm644 "$srcdir/copyright" "$pkgdir/usr/share/licenses/${NAME}/${pkgname}/"
    
      52  install -Dm755 "$srcdir/${pkgname}" "$pkgdir/usr/bin/"
    
      53  install -Dm644 "$srcdir/${pkgname}.png" "$pkgdir/usr/share/icons/hicolor/128x128/apps/"
    
      54  install -Dm644 "$srcdir/${pkgname}.desktop" "$pkgdir/usr/share/applications/"
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2