josm-latest

maintainer hauke96 · 14 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a JAR file from the project's official domain, which is normal for AUR packages; the JAR is data, not an executable binary, and the source is from the legitimate project host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a JAR file from the project's official domain, which is normal for AUR packages; the JAR is data, not an executable binary, and the source is from the legitimate project host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source=(https://josm.openstreetmap.de/download/josm-snapshot-$pkgver.jar

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Hauke Stieler <mail@hauke-stieler.de>
    
      2
    
      3# Contributor: Sven Karsten Greiner <sven@sammyshp.de>
    
      4# Contributor: Lukas Jirkovsky <l.jirkovsky@gmail.com>
    
      5# Contributor: caemir <benjamin@colard.info>
    
      6# Contributor: Eichi <mail@der-eichi.de>
    
      7# Contributor: Jaroslav Lichtblau <svetlemodry@archlinux.org>
    
      8
    
      9pkgname=josm-latest
    
      10pkgver=19606
    
      11pkgrel=1
    
      12pkgdesc="Nightly builds of JOSM, the editor for OpenStreetMap written in Java"
    
      13arch=('any')
    
      14url="https://josm.openstreetmap.de/"
    
      15license=('GPL')
    
      16depends=('desktop-file-utils' 'hicolor-icon-theme' 'java-runtime>=11' 'libxtst' 'ttf-font')
    
      17makedepends=('subversion')
    
      18backup=('etc/conf.d/josm')
    
      19conflicts=('josm' 'josm-stable' 'josm-svn')
    
      20provides=('josm=${pkgver}')
    
      21source=(https://josm.openstreetmap.de/download/josm-snapshot-$pkgver.jar
    
      22        josm.conf.d
    
      23        josm.sh
    
      24        josm::svn+https://josm.openstreetmap.de/svn/trunk#revision=$pkgver)
    
      25noextract=(josm-snapshot-$pkgver.jar)
    
      26sha256sums=('SKIP'
    
      27            '6db39276130f0fd17ce04e02801ebd28cffe14e8216393950d45900b6f4dbbbb'
    
      28            'a30c4824de1570af66e9df2bcbab777b9efea80914a07de498fcfac58789731e'
    
      29            'SKIP')
    
      30
    
      31package() {
    
      32  cd "${srcdir}"
    
      33
    
      34  #.desktop and icon file
    
      35  install -Dm644 josm/native/linux/tested/usr/share/applications/org.openstreetmap.josm.desktop \
    
      36        "${pkgdir}"/usr/share/applications/org.openstreetmap.josm.desktop
    
      37  install -Dm644 josm/native/linux/tested/usr/share/man/man1/josm.1 \
    
      38        "${pkgdir}"/usr/share/man/man1/josm.1
    
      39  install -Dm644 josm/native/linux/tested/usr/share/metainfo/org.openstreetmap.josm.appdata.xml \
    
      40        "${pkgdir}"/usr/share/metainfo/org.openstreetmap.josm.appdata.xml
    
      41  install -Dm644 josm/native/linux/tested/usr/share/icons/hicolor/scalable/apps/org.openstreetmap.josm.svg \
    
      42        "${pkgdir}"/usr/share/icons/hicolor/scalable/apps/org.openstreetmap.josm.svg
    
      43
    
      44  for _icon in 8 16 22 24 32 36 40 42 48 64 72 80 96 128 192 256 512; do
    
      45      install -Dm644 josm/native/linux/tested/usr/share/icons/hicolor/${_icon}x${_icon}/apps/org.openstreetmap.josm.png \
    
      46        "${pkgdir}"/usr/share/icons/hicolor/${_icon}x${_icon}/apps/org.openstreetmap.josm.png
    
      47  done
    
      48
    
      49  #executable file
    
      50  #install -d "${pkgdir}"/usr/bin
    
      51  install -Dm644 josm-snapshot-$pkgver.jar "${pkgdir}"/usr/share/java/josm/josm.jar
    
      52  install -Dm755 "josm.sh" "${pkgdir}"/usr/bin/josm
    
      53
    
      54  # configuration
    
      55  install -Dm644 "josm.conf.d" "${pkgdir}"/etc/conf.d/josm
    
      56}
    
      57

Changes since previous scan

--- PKGBUILD @ 2026-07-27 00:24
+++ PKGBUILD @ 2026-08-03 00:08
@@ -7,7 +7,7 @@
 # Contributor: Jaroslav Lichtblau <svetlemodry@archlinux.org>
 
 pkgname=josm-latest
-pkgver=19605
+pkgver=19606
 pkgrel=1
 pkgdesc="Nightly builds of JOSM, the editor for OpenStreetMap written in Java"
 arch=('any')

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 05:34:42	MEDIUM	1
2026-07-27 00:24:32	LOW	2
2026-07-26 05:31:42	MEDIUM	1
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 05:27:22	MEDIUM	1
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2