ktlsp-bin

LOW

maintainer winlogon 0 votes scanned 2026-08-26 01:28:49.644801

View on AUR

Why flagged

The package downloads a prebuilt server zip from a community-maintained Codeberg release; while the host is not a major forge whitelist entry, it is the project's own official release page, and the payload is not executed directly but installed as a static server component with a clear license modification in prepare().

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt server zip from a community-maintained Codeberg release; while the host is not a major forge whitelist entry, it is the project's own official release page, and the payload is not executed directly but installed as a static server component with a clear license modification in prepare().

PKGBUILD

      1# Maintainer: winlogon <walker84837 at gmail dot com>
    
      2
    
      3pkgname=ktlsp-bin
    
      4_tag=v1.4.0-rc1
    
      5pkgver=1.4.0rc1
    
      6pkgrel=1
    
      7pkgdesc="A community-maintained fork of fwcd/kotlin-language-server, providing Kotlin support via LSP"
    
      8arch=('any')
    
      9url="https://codeberg.org/winlogon/ktlsp"
    
      10license=('MIT')
    
      11depends=('java-runtime=21')
    
      12provides=('ktlsp' 'kotlin-language-server')
    
      13conflicts=('ktlsp' 'kotlin-language-server' 'kotlin-language-server-bin'
    
      14	'kotlin-language-server-git')
    
      15source=("${pkgname}-${_tag}-server.zip::${url}/releases/download/${_tag}/server.zip"
    
      16	"LICENSE.txt::${url}/raw/tag/${_tag}/LICENSE.txt")
    
      17sha256sums=('27d33f2879d12076174741488721896098e8494f5d906f99ef1c85d6159d42b7'
    
      18	'1690b72b5a2beb330c98c0715929bf789cb8d91670c29ff2e4abcdae84329136')
    
      19
    
      20prepare() {
    
      21	# As of 1.4.0-rc1, ktlsp does not yet carry the maintainer's copyright line. It's inserted here
    
      22	# until it makes it in the next upstream release. Adding it to the v1.4.0-rc1 tag would require
    
      23	# rewriting history.
    
      24	grep -q '^Copyright (c).*winlogon' "$srcdir/LICENSE.txt" ||
    
      25		sed -i '/^Copyright (c) 2018 fwcd$/a Copyright (c) 2026 winlogon' \
    
      26			"$srcdir/LICENSE.txt"
    
      27}
    
      28
    
      29package() {
    
      30	install -d "$pkgdir/usr/share/java" "$pkgdir/usr/bin"
    
      31	cp -r "$srcdir/server" "$pkgdir/usr/share/java/$pkgname"
    
      32	ln -srf \
    
      33		"$pkgdir/usr/share/java/$pkgname/bin/kotlin-language-server" \
    
      34		"$pkgdir/usr/bin/kotlin-language-server"
    
      35	install -Dm644 "$srcdir/LICENSE.txt" \
    
      36		"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-26 01:28:49	Low	2