jtool2

maintainer lapsus · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package downloads a prebuilt binary from the project's official domain, which is a normal practice for this tool; the binary is installed directly, no obfuscation or remote code execution is present, and the source host, while not on common whitelists, is the author's documented site.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt binary from the project's official domain, which is a normal practice for this tool; the binary is installed directly, no obfuscation or remote code execution is present, and the source host, while not on common whitelists, is the author's documented site.

PKGBUILD

      1# Maintainer: Yakov Till <yakov.till@gmail.com>
    
      2
    
      3pkgname=jtool2
    
      4pkgver=2.0.2
    
      5pkgrel=1
    
      6pkgdesc="Mach-O binary inspection utility combining otool, nm, atos, dyldinfo, segedit, pagestuff and codesign functionality"
    
      7arch=('x86_64')
    
      8url="http://www.newosxbook.com/tools/jtool.html"
    
      9license=('LicenseRef-jtool2')
    
      10depends=('glibc')
    
      11options=('!debug')
    
      12
    
      13# Upstream ships no license file in any artifact; the terms exist only as prose on
    
      14# the url= page. Nothing is installed under /usr/share/licenses rather than
    
      15# synthesizing a text upstream never wrote, so namcap's missing-license-file error
    
      16# on this package is expected and unfixable here.
    
      17
    
      18# Upstream publishes a single unversioned URL and replaces the binary in place,
    
      19# so the version lives only in a string inside the payload.
    
      20_dlurl="https://www.newosxbook.com/files/jtool2.ELF64"
    
      21
    
      22source=("${pkgname}-${pkgver}::${_dlurl}")
    
      23sha256sums=('29c48c21911c18dd8b91f5e07cac37b7f8c02dbbb1ee27da999497695ee3e3d1')
    
      24
    
      25latestver() {
    
      26    curl -fsSL "$_dlurl" |
    
      27        grep -aoE 'PROGRAM: JTool [0-9.]+' |
    
      28        head -1 |
    
      29        sed 's/^PROGRAM: JTool //'
    
      30}
    
      31
    
      32package() {
    
      33    install -Dm755 "${srcdir}/${pkgname}-${pkgver}" "${pkgdir}/usr/bin/${pkgname}"
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 00:17:07	LOW	2
2026-08-12 00:27:08	LOW	2
2026-08-11 21:21:47	LOW	2