jrosetta

LOW

maintainer MRWITEK 27 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads prebuilt JAR files from a personal GitHub Pages domain, which is a non-standard host, but the files are verified via multiple checksums and are installed as static Java libraries; the worst case of a malicious swap would be code execution via the JAR, but the source is not executed during build and the checksums provide strong verification, making the risk low.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt JAR files from a personal GitHub Pages domain, which is a non-standard host, but the files are verified via multiple checksums and are installed as static Java libraries; the worst case of a malicious swap would be code execution via the JAR, but the source is not executed during build and the checksums provide strong verification, making the risk low.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 "https://mrwitek.github.io/aur-repo/jrosetta-api-1.0.4.jar"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Victor Dmitriyev <mrvvitek@gmail.com>
    
      2# Contributor: Alucryd <alucryd at gmail dot com>
    
      3# Contributor: Stefan Husmann <stefan-husmann at t-online dot de>
    
      4# Contributor: Simon Lipp <sloonz+aur at gmail dot com>
    
      5
    
      6pkgname=jrosetta
    
      7pkgver=1.0.4
    
      8pkgrel=5
    
      9pkgdesc="Graphical console engine for Swing"
    
      10arch=('any')
    
      11url="http://dev.artenum.com/projects/JRosetta/"
    
      12license=('GPL2')
    
      13depends=('java-runtime')
    
      14#source=("http://maven.artenum.com/content/groups/public/com/artenum/jrosetta/jrosetta-api/$pkgver/jrosetta-api-$pkgver.jar"
    
      15#"http://maven.artenum.com/content/groups/public/com/artenum/jrosetta/jrosetta-engine/$pkgver/jrosetta-engine-$pkgver.jar")
    
      16source=(
    
      17"https://mrwitek.github.io/aur-repo/jrosetta-api-1.0.4.jar"
    
      18"https://mrwitek.github.io/aur-repo/jrosetta-engine-1.0.4.jar"
    
      19)
    
      20md5sums=('00082a2e745c8e0042608650334a9aaf'
    
      21         'cdef53b29bce0ccd46d9986996df40a6')
    
      22sha1sums=('18897a184332af2572c2e965da05db8ecd8a61c8'
    
      23          'e2537ebc971c4b095f3998463df9de0616ba656b')
    
      24sha256sums=('45703efaed9b4eb46830814ca5c5b19220021064a65ed225daa5b74a95c38044'
    
      25            '291e5c5fd8e7335e9ef8b241ae8ee0b3acd7936fc2fe83a632d12e66acd2380e')
    
      26sha512sums=('7f6e8fefd70b34a21c884920c6aa5b3e8d03b3e4c6c4fe86a449496307c460c7f96c9277983afdc36547725f68189dfcd0fa97556070b43b7d9d2b221e73ed6a'
    
      27            '18eb337308b32c96e23d70d760abdecc917baa627ff50dda9f166a7056eaed77d7b9bffcca907f9fc32157a6edbeef9370759f630f111b2d692071ba30c34b0c')
    
      28noextract=("jrosetta-engine-$pkgver.jar" "jrosetta-api-$pkgver.jar")
    
      29
    
      30package() {
    
      31      cd "$srcdir"
    
      32      install -Dm644 "$srcdir/$pkgname-api-$pkgver.jar" "$pkgdir/usr/share/java/$pkgname/$pkgname-API.jar"
    
      33      install -Dm644 "$srcdir/$pkgname-engine-$pkgver.jar" "$pkgdir/usr/share/java/$pkgname/$pkgname-engine.jar"
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2