kanjitomo

maintainer sowieso · 7 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a source archive from a non-whitelisted but project-owned domain (kanjitomo.net), which is normal for AUR packages; the downloaded content is a self-contained Java application installed as data, with no remote code execution or obfuscated payloads, making the worst-case impact limited to application integrity, not system compromise.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package downloads a source archive from a non-whitelisted but project-owned domain (kanjitomo.net), which is normal for AUR packages; the downloaded content is a self-contained Java application installed as data, with no remote code execution or obfuscated payloads, making the worst-case impact limited to application integrity, not system compromise.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:8 source=("KanjiTomo.zip::http://kanjitomo.net/download.php")

PKGBUILD

1 offending line(s) highlighted

      1pkgname='kanjitomo'
    
      2pkgdesc="identify Japanese characters from images or screen"
    
      3pkgver=1.0.4
    
      4pkgrel=4
    
      5arch=('any')
    
      6license=('custom')
    
      7url="http://kanjitomo.net"
    
      8source=("KanjiTomo.zip::http://kanjitomo.net/download.php")
    
      9sha256sums=('db3e7f23019b65435c236c3922700e78b8747ea980d74298a1d08ff36a38a31c')
    
      10depends=('java-environment')
    
      11backup=("etc/kanjitomo.conf")
    
      12
    
      13package () {
    
      14  cd "$srcdir/KanjiTomo"
    
      15  # install
    
      16  mkdir -p "$pkgdir/usr/share/$pkgname"
    
      17  cp -r data images lib wallpaper KanjiTomo.jar "$pkgdir/usr/share/$pkgname"
    
      18  # licenses
    
      19  mkdir -p "$pkgdir/usr/share/licenses/$pkgname/"
    
      20  cp LICENSE.txt "$pkgdir/usr/share/licenses/$pkgname/${pkgname}_license"
    
      21  sed -n '/## ACKNOWLEDGEMENTS ##/,$p' README.txt > "$pkgdir/usr/share/licenses/$pkgname/libraries_license_information"
    
      22  # starter
    
      23  mkdir -p "$pkgdir/usr/bin/"
    
      24  echo -e "#!/bin/bash\ncd /usr/share/kanjitomo\nexec java -Xmx1200m -jar KanjiTomo.jar -run" > "$pkgdir/usr/bin/$pkgname"
    
      25  chmod +x "$pkgdir/usr/bin/$pkgname"
    
      26  # default config
    
      27  mkdir -p "$pkgdir/etc"
    
      28  cp config.txt "$pkgdir/etc/kanjitomo.conf"
    
      29  ln -s "/etc/kanjitomo.conf" "$pkgdir/usr/share/$pkgname/config.txt"
    
      30  sed -i "s/ENABLE_HOTKEYS=0/ENABLE_HOTKEYS=1/" "$pkgdir/etc/kanjitomo.conf"
    
      31  # desktopfile
    
      32  mkdir -p "$pkgdir/usr/share/applications/"
    
      33  echo -e "[Desktop Entry]\nName=$pkgname\nComment=$pkgdesc\nExec=/usr/bin/$pkgname\nTerminal=false\nType=Application\nCategories=Education\nIcon=$pkgname" \
    
      34    > "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      35  # desktopfile image, feel free to remove
    
      36  mkdir -p "$pkgdir/usr/share/pixmaps/"
    
      37  echo -n "iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAAABmJLR0QA/wD/AP+gvaeTAAAACXBI
    
      38WXMAAAsTAAALEwEAmpwYAAAAB3RJTUUH4AYKDQ0DHhIYQgAAAB1pVFh0Q29tbWVudAAAAAAAQ3Jl
    
      39YXRlZCB3aXRoIEdJTVBkLmUHAAALOElEQVR42u1abY8cRxF+qqf37mwL/hfYjp0XHJxAbGRBkEGA
    
      40sCAkjmPHYBQCIUGgoAgFKzEQAklQwOaHhSi+253phw9d3V3dM7N33K3yhVtrtJ7bme7qeq+nSoCb
    
      41RPVJt2KuYP7mAPSA9M0rvT63jL+R+sMQL+kBoT6b1u0AeggcAA/AgcK4Bxfxd3SA+Pg8O91wwKZo
    
      429pHwdjElAs4slhbShema9zp9ZiseRgaAQ/wTgx4qER7iHgwABjCv7fSQTmnw8Vna/Q0NG6DZA0tM
    
      43f5xZIHESZpOu4b5rDjdErrPXZwPAPf19qLUDRgll2zDLFy2o9sTGaPbAqlkkqRDLt+iipB7A62Vf
    
      44Y7NpOmgfv/OB+qKOTGYTAAmGed686w0D2gMenWYPUQZQCvECY4fJbtlwOQDoIHCqwt5wVwwDgvEP
    
      45DpHhS4ArfW5lhEJEegYj+aGRoKhP2AzNagLWvvQleiMBs1H6n4jalNeNfaNexoaxMHbrzJUEZv3Q
    
      46oNpgmeJ0r2HCvo9Gc2QABZCuEEWZsC0alxOdlVQqyeLZ9VsgoLV5YSRAOv0WoxV7jS9BdKTZwYVa
    
      47khuiOTJAnFG1KXtyxoNyxg599qySbdZKi4Ds1E6Nztg3IxPojU9geV/0WYr6kM3Q7LMtiiXKNR7U
    
      4867qDsVuCMkCo6i0phFktCLWHx0JpYRPCrM2HOpokreFQmEFujGYf36GxQ5Ok5INs6+GSd9ZvBhAE
    
      49ZKESicRSCRH9ByyiCoagUnRGYnoJjEaslFF9SZzEhk+/MZp9lpCgVhcau6NNKFRK0ukzMN/DROyV
    
      50Jlmx2Zkv0men5uMjgSkBElbOrHK0G6DZl+ysCauZSLW5HJK8qpMvdprV02eVFnhAPEiZYIRKS2iI
    
      51HozJ0OQEfW0ynEqFD0+zH6WVKQSJ8ewplc2LueKskg2zxHtBALCtTJYmgWFJnQkIAogi/cII32SN
    
      529rM5mn3xjGxieGhU1iY0YgjVOC+DxnuCWaopJi8AOPUHxe5Z5fCd3q+axMerratDFDTe/Wg0+7iJ
    
      53fVkmqiyb5yfu9+byAHaaDXo9zBYEVAmbkJiruiZBkk7V02nG1k0c0m2MZo+DfGSi+qqk3KnD2ipF
    
      54EBZFI7Ln9pk4qYhtExjXxPcSYXLU2hDNB2PAqPxMTFfuJkfFlUp921R6ySd4UJwe3oOcqewo2XnR
    
      55pszJVMiDMeCANO/DAK4h0tWc5p5ylkbtaFYZctJSbH8uRM5dVvU3Q7MfhdhqIY3DrbSEdSgSU8jg
    
      56M319G5CTmpBEXwBxBZ1JwEebFbKktaIGVIc9h03S7MtqMuFM5GDaNmmDKwAPNW/XEjicMJmaTBQx
    
      570oAkXAN7bYZmX8fmGDoY/qFh9cyYx+F+9Vt7X9vgrkp7adCYkv2Rb8R35ScN40LJ2CbFXWhm+EjX
    
      58OD/j/PbDkGjTxlgvizxqDucOpwE53A8FBMF/mit9PlNteVgQpJwfTK3tapu26TXd/0SzAF9lthug
    
      595N8kyI8Op/3udFZv8j6O8hG5kiu5Uf4gBMPfdM/HS4TIhdM6ycTj+6IyCVoq3yKP64K9Ubl/GZUn
    
      60GB7E++7LtTAolfbG50MDeYuiNIucLSZBMNzVNyNERv55vcKFDw8unIw1dOMwyPB3Pf+TBmqyEnnM
    
      61gBSEuC/lxQ6kcBWun2r+pQFJfGP3yxgR5MmJqAMwvG/otcT2Ez5pKMLJGjBSuYsg3wP5PkS+VlwF
    
      62/3pADp9ZI6UHB1T7xxoGyAz6hBpsGTlKjIEX0kB0AwTyFZZuDXIBQr6rxDyjBc49vf86ADG/X4yR
    
      63g0kSj+yTiVk7LIkQw7/1/bPjg0gTMmWhma3avzw1wRTObG5L793UFzCVFzo1zUsGWrLc3KklIjuN
    
      64w9k26tfG8rZdVWtGtM9W2kPzjjMVY8I2/rKPRn2zRqBEc42ICmMmqbB/78xmf2jU+m7z/BeUAUvt
    
      65E4bZsJZyiGI6csSIcclUlR4Mb00ITYsibcQI5DwLVu6btlJKVxcGX9MmJn+pmz7XlKorw4A9jSD6
    
      66Nxq0R4KR/JmDOdAU4wUlWZOnlZ5kot/Q+7f1/vvmXNKYwz7FEHl3/3yHv5hwhNcALkbaMu8c7x/a
    
      67sR68KrRYZeknCOQcSwnaVbk6+Scl4JIiM9s5XpOvK4dfMO8U6RZprzTM9QAfmibIXk6S6gPKvDNj
    
      68ouufuvcTFc1triDuSkVz6S34/E5BhWEaEeJyfI0SemeNBvx8xh5vGBzfGex/2agjCshBrk9jZcqp
    
      69FprFXTCZ4UWDASogmg+ezHV7ygTqNFLcWX25IDUp5JXDfhfAqQbFkQavd6Y35+qwxc44yjDT8kad
    
      70icr5BvYacmEUn3tPM9m035Zqgol2CrkUMWgIyhWWO6tE9VGNZdfE+wuaAwDk7wD5JF74VIubXZX2
    
      71UGN3kiY+tg0DTgHciURSCxpqryDfO5OGn1tLc65U+SEgu7HIkk+VNnPJJ/AFgJC63Zwko2Mt5MdG
    
      724qf1OQ+RJ0B+AIbfm+LFGy5LySMkNTzaTO2kwe5XE11mgkxe/9FKuxg+aDLISLPIOZAfG405XUwh
    
      735zsrCPA0bZKRPL+4pwD02abyIjKYURYDVYnPdUROPiqVF13/txP+4lsmaeonGVD7nXvN+5c1zx8K
    
      74LEe9Zw/ygXn2kYpmAa5w3LgIxuEo2JkX7w1YYdtUyU8YOxNlUmaWm/A3TZuLbBgQJtJaYlM0+6h+
    
      75YuIjx9MXWGmnZVWPvdjxFmtK4BrIe8bBcS4bDY02NADIEWn2wInaU1ecTaXp0izQG9yur+DvsYQw
    
      76M8uDJilZV+lxRgM2Q7OP4QuNPXdlkiPb+zDR+UnqNWA8bNXOBM7B3FN/x8T9FJOOTrMXG47yKImr
    
      77+viS7TouRAxNIuOaNtUcMutmDm67QX0j3bHvkKb2PwrNfgwkyAxxaJqOU+qsw48S1BVw4hnZBy3y
    
      78mQEidnBynZkcnmbTHp9yMLaXVjo+ou2K2ql2RtVM8iMthmVHWzAmOkUTCeq4U1d5qsA5Os2eLXZm
    
      79Bx5T8VENM3KmA+XqkZc84GDXHmrvLRaOt4ONUkme++EER6DZx5QVIG9ponBT71/W+9uF4xSQN9WE
    
      80rptBhw7kHWNe39Fn38zZYa7P3TNgeDdXawxvzxRTP9Lmye2J325N0lyq2JvlOUNzvcZ1AD1c8YzI
    
      81aGo5/EuVJ7ULMdwpefrIRndiq3y2xE2LrCByWUGMRNi3IXIVwBLkK/q35yHyAkReNAfvTWb4cgZd
    
      826sMGw4ybELmhVSpUYB1chq7yYndMu2plJizCDBJbz+CK3ADDawBPNDiirfws3meHJAHIXrxUM+Nn
    
      83V59ZNmgxKsFNQ+HWRBcNeryAqwuQdIhrRvKDOqSfZa2IZgGQL40XlXTwU2bFL5r/W8ZYIMUclsua
    
      84KQqg1ExZGXp/CPJVkK9A5McTvgG5eKsiiGyZYemq2HgN4n7QDB6n3243AahrnNQ2xP0a5Iszhz7Z
    
      85aFC7vx2WthrQZI0V3f0MgsSJUNhVdKkJWG5eVRt/Y1L9RW7ByU+bmGw0gAszOD3FAJt4bUXAtSJK
    
      86EVsZmsOuGrWvGSDuKkS+N8sMASAiOitcaI0MoFlYeog8qwx8XR3Lq9kZxdEVQiQ6qMBrjRPsFCd4
    
      87a4YBO01PYadhSkmWxF1QYdwD+Y4p1S+PaC6zSUPNGHle6byBEK4j8Dk9y280wMpFjgaTKLDjbWXw
    
      88OIEcW4jTX/GeGWaKY7F2WDpNi5PPKvG/QmH6ssDn2dGtxvHb5g4Ute3N0Py5DEvnw3dvRhP5fxuW
    
      89dvJHhR93cDwsXan08bD08bD08bD08bD08bD0BK5wPCyN42Hp42Hpz2dY+r+ou5kCpsrfuwAAAABJ
    
      90RU5ErkJggg==" | base64 -d > "$pkgdir/usr/share/pixmaps/$pkgname.png"
    
      91}
    
      92

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2