jam-cli-bin

MEDIUM

maintainer Quatro 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads prebuilt binaries from a non-whitelisted host (native.jam.dev) with no public source build alternative, creating a supply-chain risk if the host is compromised or the download is intercepted.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("jam-terms.html::https://jam.dev/legal/terms")
PKGBUILD:21 source_x86_64=("$pkgname-$pkgver-x86_64::https://native.jam.dev/download/linux/x64?version=$pkgver")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt binaries from a non-whitelisted host (native.jam.dev) with no public source build alternative, creating a supply-chain risk if the host is compromised or the download is intercepted.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Xavier Francisco <echo moc.liamg@ocsicnarf.n.reivax | rev>
    
      2
    
      3pkgname=jam-cli-bin
    
      4pkgver=1.19.0
    
      5pkgrel=1
    
      6pkgdesc="CLI for reading and creating Jam bug reports (prebuilt binary)"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://jam.dev/docs/cli"
    
      9license=('LicenseRef-Jam-Terms')
    
      10depends=('glibc')
    
      11optdepends=('xdg-utils: browser-based authentication')
    
      12provides=('jam-cli')
    
      13conflicts=('jam' 'jam-cli')
    
      14options=('!debug' '!strip')
    
      15source=("jam-terms.html::https://jam.dev/legal/terms")
    
      16# Per-arch sources need DISTINCT output filenames. A shared name makes makepkg
    
      17# (and updpkgsums, which runs `makepkg -g`) fetch only the first, then reuse that
    
      18# file for the second arch — silently copying the x86_64 hash into
    
      19# sha256sums_aarch64. Literal arch suffixes (not $CARCH, which expands to the host
    
      20# arch for both arrays during checksum generation) keep the two downloads separate.
    
      21source_x86_64=("$pkgname-$pkgver-x86_64::https://native.jam.dev/download/linux/x64?version=$pkgver")
    
      22source_aarch64=("$pkgname-$pkgver-aarch64::https://native.jam.dev/download/linux/arm64?version=$pkgver")
    
      23sha256sums=('c95521fd1516058c380424ccd8a8c83b62a2a221acb71e18af7b719af0a006ac')
    
      24sha256sums_x86_64=('4fec87df92b027cbd12bf5a83f8d48f25d4c7aaabf0d003bda139c01ac656476')
    
      25sha256sums_aarch64=('9ed564358bcca9bc8b933b9250845668ef17b29787da15830a49835a94471523')
    
      26
    
      27package() {
    
      28  install -Dm755 "$pkgname-$pkgver-$CARCH" "$pkgdir/usr/bin/jam"
    
      29  install -Dm644 jam-terms.html "$pkgdir/usr/share/licenses/$pkgname/TERMS.html"
    
      30}
    
      31

Changes since previous scan

--- PKGBUILD @ 2026-09-06 00:17
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,7 +1,7 @@
 # Maintainer: Xavier Francisco <echo moc.liamg@ocsicnarf.n.reivax | rev>
 
 pkgname=jam-cli-bin
-pkgver=1.17.0
+pkgver=1.19.0
 pkgrel=1
 pkgdesc="CLI for reading and creating Jam bug reports (prebuilt binary)"
 arch=('x86_64' 'aarch64')
@@ -20,9 +20,9 @@
 # arch for both arrays during checksum generation) keep the two downloads separate.
 source_x86_64=("$pkgname-$pkgver-x86_64::https://native.jam.dev/download/linux/x64?version=$pkgver")
 source_aarch64=("$pkgname-$pkgver-aarch64::https://native.jam.dev/download/linux/arm64?version=$pkgver")
-sha256sums=('fe9f2f609a7c13ed544c0ff00e40e43678435a3dd74df424bd424ac5b8a00f3b')
-sha256sums_x86_64=('a888edd7178714dd6f1bd4c74b16a9376bd682c5f9c65d029852c5510bc7ebb0')
-sha256sums_aarch64=('591c759bfc2f60ef77a7e348be28e9548bdd65e9d74faa787395f99d9ff77844')
+sha256sums=('c95521fd1516058c380424ccd8a8c83b62a2a221acb71e18af7b719af0a006ac')
+sha256sums_x86_64=('4fec87df92b027cbd12bf5a83f8d48f25d4c7aaabf0d003bda139c01ac656476')
+sha256sums_aarch64=('9ed564358bcca9bc8b933b9250845668ef17b29787da15830a49835a94471523')
 
 package() {
   install -Dm755 "$pkgname-$pkgver-$CARCH" "$pkgdir/usr/bin/jam"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 03:10:21	Medium	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 03:41:10	Medium	1