jgoodies-looks

maintainer MRWITEK · 21 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a Java library JAR file hosted on a personal GitHub Pages site, but the package installs only the JAR and license, with no execution of remote code or obfuscated payloads, and the checksums are provided and verifiable.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a Java library JAR file hosted on a personal GitHub Pages site, but the package installs only the JAR and license, with no execution of remote code or obfuscated payloads, and the checksums are provided and verifiable.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("https://mrwitek.github.io/aur-repo/jgoodies-looks-2_8_0-20150402.zip")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Victor Dmitriyev <mrvvitek@gmail.com>
    
      2# Contributor: Alucryd <alucryd at gmail dot com>
    
      3# Contributor: Stefan Husmann <stefan-husmann at t-online dot de>
    
      4# Contributor: David Hajek <dante4d at gmail dot com>
    
      5# Contributor: Geoffroy Carrier <geoffroy dot carrier at koon dot fr>
    
      6# Contributor: Otto Allmendinger <otto.allmendinger@gmail.com>
    
      7
    
      8pkgname=jgoodies-looks
    
      9pkgver=2.8.0
    
      10pkgrel=4
    
      11pkgdesc="A Java Swing look and feel library"
    
      12arch=('any')
    
      13url="http://www.jgoodies.com/"
    
      14license=('BSD')
    
      15groups=('jgoodies')
    
      16depends=('java-runtime')
    
      17#source=("http://www.jgoodies.com/download/libraries/looks/jgoodies-looks-${pkgver//./_}-20150402.zip")
    
      18source=("https://mrwitek.github.io/aur-repo/jgoodies-looks-2_8_0-20150402.zip")
    
      19md5sums=('89a28c43d742142869077e3ebeb109c9')
    
      20sha1sums=('6fd9cddd9ad82044dd603acb3a38a925cfa9e3e8')
    
      21sha256sums=('2b9382063f3058992db088fcf99fec04d41396b37e1e155f3af3b6c091435297')
    
      22sha512sums=('40b524f3ea082f322bda221cd57c58a97128625a51af6bbb86433d69e74bec4f366e551e9fafa0062bf98a1ee1786267906e6ec1994507f6b3b8d5d1148e42f7')
    
      23
    
      24package() {
    
      25  cd "${srcdir}/${pkgname}-${pkgver}"
    
      26  install -Dm644 "LICENSE.txt" "${pkgdir}/usr/share/licenses/${pkgname}/license.txt"
    
      27  install -Dm644 "${pkgname}-${pkgver}.jar" "${pkgdir}/usr/share/java/${pkgname}/${pkgname}.jar"
    
      28}
    
      29
    
      30# vim:set ts=2 sw=2 et:
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2