josm-latest
LOW
maintainer hauke96
14 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a JAR file from the official project domain over HTTPS; despite the non-whitelisted host and skipped checksum, it is a legitimate build artifact from the project's own infrastructure, not an untrusted executable or malicious payload.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a JAR file from the official project domain over HTTPS; despite the non-whitelisted host and skipped checksum, it is a legitimate build artifact from the project's own infrastructure, not an untrusted executable or malicious payload.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:21
source=(https://josm.openstreetmap.de/download/josm-snapshot-$pkgver.jar
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Hauke Stieler <mail@hauke-stieler.de>
2
3
# Contributor: Sven Karsten Greiner <sven@sammyshp.de>
4
# Contributor: Lukas Jirkovsky <l.jirkovsky@gmail.com>
5
# Contributor: caemir <benjamin@colard.info>
6
# Contributor: Eichi <mail@der-eichi.de>
7
# Contributor: Jaroslav Lichtblau <svetlemodry@archlinux.org>
8
9
pkgname=josm-latest
10
pkgver=19667
11
pkgrel=1
12
pkgdesc="Nightly builds of JOSM, the editor for OpenStreetMap written in Java"
13
arch=('any')
14
url="https://josm.openstreetmap.de/"
15
license=('GPL')
16
depends=('desktop-file-utils' 'hicolor-icon-theme' 'java-runtime>=11' 'libxtst' 'ttf-font')
17
makedepends=('subversion')
18
backup=('etc/conf.d/josm')
19
conflicts=('josm' 'josm-stable' 'josm-svn')
20
provides=('josm=${pkgver}')
21
source=(https://josm.openstreetmap.de/download/josm-snapshot-$pkgver.jar
22
josm.conf.d
23
josm.sh
24
josm::svn+https://josm.openstreetmap.de/svn/trunk#revision=$pkgver)
25
noextract=(josm-snapshot-$pkgver.jar)
26
sha256sums=('SKIP'
27
'6db39276130f0fd17ce04e02801ebd28cffe14e8216393950d45900b6f4dbbbb'
28
'a30c4824de1570af66e9df2bcbab777b9efea80914a07de498fcfac58789731e'
29
'SKIP')
30
31
package() {
32
cd "${srcdir}"
33
34
#.desktop and icon file
35
install -Dm644 josm/native/linux/tested/usr/share/applications/org.openstreetmap.josm.desktop \
36
"${pkgdir}"/usr/share/applications/org.openstreetmap.josm.desktop
37
install -Dm644 josm/native/linux/tested/usr/share/man/man1/josm.1 \
38
"${pkgdir}"/usr/share/man/man1/josm.1
39
install -Dm644 josm/native/linux/tested/usr/share/metainfo/org.openstreetmap.josm.appdata.xml \
40
"${pkgdir}"/usr/share/metainfo/org.openstreetmap.josm.appdata.xml
41
install -Dm644 josm/native/linux/tested/usr/share/icons/hicolor/scalable/apps/org.openstreetmap.josm.svg \
42
"${pkgdir}"/usr/share/icons/hicolor/scalable/apps/org.openstreetmap.josm.svg
43
44
for _icon in 8 16 22 24 32 36 40 42 48 64 72 80 96 128 192 256 512; do
45
install -Dm644 josm/native/linux/tested/usr/share/icons/hicolor/${_icon}x${_icon}/apps/org.openstreetmap.josm.png \
46
"${pkgdir}"/usr/share/icons/hicolor/${_icon}x${_icon}/apps/org.openstreetmap.josm.png
47
done
48
49
#executable file
50
#install -d "${pkgdir}"/usr/bin
51
install -Dm644 josm-snapshot-$pkgver.jar "${pkgdir}"/usr/share/java/josm/josm.jar
52
install -Dm755 "josm.sh" "${pkgdir}"/usr/bin/josm
53
54
# configuration
55
install -Dm644 "josm.conf.d" "${pkgdir}"/etc/conf.d/josm
56
}
57
Changes since previous scan
--- PKGBUILD @ 2026-10-28 00:06+++ PKGBUILD @ 2026-11-01 00:21@@ -7,7 +7,7 @@ # Contributor: Jaroslav Lichtblau <svetlemodry@archlinux.org> pkgname=josm-latest-pkgver=19665+pkgver=19667 pkgrel=1 pkgdesc="Nightly builds of JOSM, the editor for OpenStreetMap written in Java" arch=('any')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 05:49:54 | Medium | 1 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 05:46:44 | Medium | 1 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 05:43:49 | Medium | 1 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 05:39:24 | Medium | 1 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 05:36:55 | Medium | 1 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 05:34:05 | Medium | 1 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |