jpgcrush

maintainer keenerd · 18 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a tarball from the maintainer's personal domain, which is not on a standard whitelist, but the package builds from unobfuscated scripts and installs only data and executable files from that source; the worst case of a swapped source is limited to code injection via the Perl script, but given the project's simplicity and lack of privileged execution, the risk is low.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The source is a tarball from the maintainer's personal domain, which is not on a standard whitelist, but the package builds from unobfuscated scripts and installs only data and executable files from that source; the worst case of a swapped source is limited to code injection via the Perl script, but given the project's simplicity and lack of privileged execution, the risk is low.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=(http://akuvian.org/src/$pkgname.tar.gz)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kyle Keen <keenerd@gmail.com>
    
      2pkgname=jpgcrush
    
      3pkgver=0.0.0
    
      4pkgrel=2
    
      5pkgdesc="Lossless jpeg re-compressor."
    
      6arch=('any')
    
      7url="http://akuvian.org/"
    
      8license=('custom:publicdomain')
    
      9depends=('perl-file-slurp' 'libjpeg')
    
      10source=(http://akuvian.org/src/$pkgname.tar.gz)
    
      11md5sums=('c3c5fb5f228e3f5cced70c6982e0a38e')
    
      12
    
      13build() {
    
      14  cd "$srcdir"
    
      15  sed -i 's|~/src/perl/|/usr/share/jpgcrush/|g' jpgcrush
    
      16}
    
      17
    
      18package() {
    
      19  cd "$srcdir"
    
      20  install -d "$pkgdir/usr/bin/" "$pkgdir/usr/share/jpgcrush/"
    
      21  install -Dm644 *.txt      "$pkgdir/usr/share/jpgcrush/"
    
      22  install -Dm755 jpgcrush   "$pkgdir/usr/bin/"
    
      23  install -Dm755 jpegrescan "$pkgdir/usr/bin/"
    
      24}
    
      25
    
      26
    
      27

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2