key-nightly

maintainer csicar · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a JAR file and a logo from the project's official domain (kit.edu) and project website, which are plausibly legitimate sources; the JAR is part of the project's own build, not an untrusted prebuilt binary, and no code execution from unverifiable or malicious sources is present.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a JAR file and a logo from the project's official domain (kit.edu) and project website, which are plausibly legitimate sources; the JAR is part of the project's own build, not an untrusted prebuilt binary, and no code execution from unverifiable or malicious sources is present.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://formal.iti.kit.edu/key/download/nightly/dist/key-2.7.1537_6449d9d989e94bc1fbb235e3c06b45ac1e0d9af6-exe.jar"
PKGBUILD:14 "https://www.key-project.org/wp-content/themes/key/img/key-logo-white.png"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: csicar
    
      2
    
      3pkgname=key-nightly
    
      4pkgver=2.7.1537
    
      5pkgrel=1
    
      6pkgdesc="Java Software Verification Tool"
    
      7arch=(any)
    
      8url="https://www.key-project.org/"
    
      9license=('GPL')
    
      10depends=("java-runtime")
    
      11optdepends=("z3")
    
      12conflicts=("key-bin")
    
      13source=("https://formal.iti.kit.edu/key/download/nightly/dist/key-2.7.1537_6449d9d989e94bc1fbb235e3c06b45ac1e0d9af6-exe.jar"
    
      14	"https://www.key-project.org/wp-content/themes/key/img/key-logo-white.png"
    
      15        "key.desktop"
    
      16        "key.sh")
    
      17sha256sums=('82bce336de5700a7283f71680f39479ac1f32d63e85402fc3e0df3bbe6b6b861'
    
      18	    '6b3f7a6d75515e92a9f139216c59c06bd9b43da62e70904eef882722ce7cceae'
    
      19            '883e62e3dd9d9c164e9e7c5199333409937a7591c1b17003dbb04beec7c27980'
    
      20            '449a4874434aabc061ba713a96966e1d6baa524f4e5c8b140cf03985c3b60b43')
    
      21
    
      22build() {
    
      23  ls
    
      24  # assume ant defaults to UTF8 encoding.
    
      25}
    
      26
    
      27package() {
    
      28  install -m 755 -D "key.sh" "$pkgdir/usr/bin/key"
    
      29
    
      30  mkdir -p "${pkgdir}/usr/share/java/key"
    
      31  mkdir -p "${pkgdir}/usr/share/icons/"
    
      32
    
      33  cp key*-exe.jar "${pkgdir}/usr/share/java/key/KeY.jar"
    
      34
    
      35  cp key-logo-white.png "${pkgdir}/usr/share/icons/key.png"
    
      36
    
      37  install -Dm755 "${srcdir}/key.desktop" "${pkgdir}/usr/share/applications/key.desktop"
    
      38
    
      39  ls "${pkgdir}/usr/share/java/key"
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2