jam-cli-bin

maintainer Quatro · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged Prebuilt binary downloaded from native.jam.dev, which is plausibly the project's own official distribution infrastructure (jam.dev is the vendor domain), with pinned sha256 checksums; the main concern is that it's a prebuilt executable from a versioned endpoint rather than a source build, but the host appears to be the vendor's own CDN rather than an unrelated swappable third-party host.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): Prebuilt binary downloaded from native.jam.dev, which is plausibly the project's own official distribution infrastructure (jam.dev is the vendor domain), with pinned sha256 checksums; the main concern is that it's a prebuilt executable from a versioned endpoint rather than a source build, but the host appears to be the vendor's own CDN rather than an unrelated swappable third-party host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("jam-terms.html::https://jam.dev/legal/terms")
PKGBUILD:16 source_x86_64=("$pkgname-$pkgver::https://native.jam.dev/download/linux/x64?version=$pkgver")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Xavier Francisco <echo moc.liamg@ocsicnarf.n.reivax | rev>
    
      2
    
      3pkgname=jam-cli-bin
    
      4pkgver=1.11.0
    
      5pkgrel=1
    
      6pkgdesc="CLI for reading and creating Jam bug reports (prebuilt binary)"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://jam.dev/docs/cli"
    
      9license=('LicenseRef-Jam-Terms')
    
      10depends=('glibc')
    
      11optdepends=('xdg-utils: browser-based authentication')
    
      12provides=('jam-cli')
    
      13conflicts=('jam' 'jam-cli')
    
      14options=('!debug' '!strip')
    
      15source=("jam-terms.html::https://jam.dev/legal/terms")
    
      16source_x86_64=("$pkgname-$pkgver::https://native.jam.dev/download/linux/x64?version=$pkgver")
    
      17source_aarch64=("$pkgname-$pkgver::https://native.jam.dev/download/linux/arm64?version=$pkgver")
    
      18sha256sums=('3653db64c7b32a2ba8fe73ea11bd1aeffa12aac706bf234cb202b129f088799b')
    
      19sha256sums_x86_64=('2e3da24ee4601d1c466eb77247cb9783cfc98011fd9f345dc1d355828362bd28')
    
      20sha256sums_aarch64=('c461c21460090e20bacac2c773bca5dedb5e29a3d6faad7f84699749f272663c')
    
      21
    
      22package() {
    
      23  install -Dm755 "$pkgname-$pkgver" "$pkgdir/usr/bin/jam"
    
      24  install -Dm644 jam-terms.html "$pkgdir/usr/share/licenses/$pkgname/TERMS.html"
    
      25}
    
      26

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 11:40:39	LOW	3
2026-07-28 11:38:42	MEDIUM	3