jnx

maintainer SteamedFish · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a JAR file and source tarball from the project's official website (arachnoid.com) which is the legitimate host for this software; the JAR is installed as data and not executed during build, and the source is not built but only used for an icon, posing minimal risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a JAR file and source tarball from the project's official website (arachnoid.com) which is the legitimate host for this software; the JAR is installed as data and not executed during build, and the source is not built but only used for an icon, posing minimal risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://arachnoid.com/JNX/JNX.jar"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: SteamedFish <steamedfish@hotmail.com>
    
      2
    
      3pkgname=jnx
    
      4pkgver=1.4
    
      5pkgrel=1
    
      6pkgdesc="A Java Navtex marine weather receiver/converter"
    
      7arch=('any')
    
      8url="https://arachnoid.com/JNX/"
    
      9license=('GPL-2.0-or-later')
    
      10depends=('java-runtime' 'bash')
    
      11source=("https://arachnoid.com/JNX/JNX.jar"
    
      12        "$pkgname.sh"
    
      13        "$pkgname.desktop"
    
      14        "https://arachnoid.com/JNX/JNX_source.tar.gz")
    
      15sha256sums=('a9317d79ab76e3b760036dfcd5f4c0ccc87eb4073edeea51912c8499ea360934'
    
      16            'f72e101688a86e53fc23ac07a074ef67994515cb96ec90e647df1a94738d76c5'
    
      17            'ecbfa6047b4f0c92addec02d602e6aedf82f14208949e0c1f8763a68b766c136'
    
      18            '51ffae24788ee1bab999741172d4bc460dfbf5f4637b5935b839e46394a333cb')
    
      19
    
      20package() {
    
      21    install -Dm644 "$srcdir/JNX.jar" "$pkgdir/usr/share/java/$pkgname/JNX.jar"
    
      22    install -Dm755 $pkgname.sh "$pkgdir/usr/bin/$pkgname"
    
      23    install -Dm644 $pkgname.desktop "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      24    install -Dm644 "$srcdir/src/jnx/images/JNX_icon.png" "$pkgdir/usr/share/pixmaps/jnx.png"
    
      25}
    
      26

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2