lbe

maintainer grawity · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a source archive from a personal mirror, but it is a static ZIP containing only Java JARs and data files; the worst case of a swapped source is limited to code execution within the app's sandbox, not system compromise, and the source is checksummed.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source archive from a personal mirror, but it is a static ZIP containing only Java JARs and data files; the worst case of a swapped source is limited to code execution within the app's sandbox, not system compromise, and the source is checksummed.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://nullroute.lt/mirrors/files/ldapbrowser-$pkgver.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mantas Mikulėnas <grawity@gmail.com>
    
      2
    
      3pkgname='lbe'
    
      4pkgver=2.8.2
    
      5pkgrel=12
    
      6pkgdesc="Jarek Gawor's LDAP Browser/Editor (last freeware version)"
    
      7arch=('any')
    
      8#url="http://www.openchannelsoftware.com/projects/LDAP_Browser_Editor"
    
      9url="http://web.archive.org/web/20090201080715/http://mcs.anl.gov/~gawor/ldap/"
    
      10license=('custom')
    
      11depends=('java-runtime>=8' 'java-runtime<=11')
    
      12source=("https://nullroute.lt/mirrors/files/ldapbrowser-$pkgver.zip"
    
      13        "Ldap_lic.pdf"
    
      14        "lbe.desktop"
    
      15        "lbe.sh")
    
      16sha256sums=('6c1a1b80b81d83f005d4a006bc070b1b8f44f90151f7af6b14004c96e26687ec'
    
      17            '673f71a75aafb1c1367a9b7449a8a2da6cc96235c660bb940d26cd70dba6dabe'
    
      18            'ccdc18f2879c6ab10aa0f3ad087a3aa225a6146340be7e2fb46302b961255972'
    
      19            '74e216ae7034236520c5c16addb4371dccb0dbea573cf0d735348765346ccfb1')
    
      20
    
      21package() {
    
      22  # Java program files
    
      23  # (lib/*.jar only contains a copy of JNDI, not needed for any current JRE version)
    
      24  mkdir -p "$pkgdir"/usr/lib/lbe
    
      25  cp -a lbe.jar                       "$pkgdir"/usr/lib/lbe/
    
      26
    
      27  # Docs
    
      28  mkdir -p "$pkgdir"/usr/share/doc/lbe
    
      29  cp -a *.html help CHANGES.TXT       "$pkgdir"/usr/share/doc/lbe/
    
      30
    
      31  # Initial config directory
    
      32  mkdir -p "$pkgdir"/usr/share/lbe/skel
    
      33  cp -a attributes.config templates   "$pkgdir"/usr/share/lbe/skel/
    
      34  cp -a help/uofmichigan.cfg.sample   "$pkgdir"/usr/share/lbe/skel/'U of Michigan'.cfg
    
      35  ln -s /usr/share/doc/lbe/help       "$pkgdir"/usr/share/lbe/skel/help
    
      36  ln -s /etc/ssl/certs/java/cacerts   "$pkgdir"/usr/share/lbe/skel/lbecacerts
    
      37
    
      38  # Licenses (EULA link from readme.html)
    
      39  # I guess even the "freeware" versions weren't really freeware, but it
    
      40  # doesn't look like ANL ever cared.
    
      41  mkdir -p "$pkgdir"/usr/share/licenses/lbe/
    
      42  cp -p Ldap_lic.pdf LICENSE.ICONS    "$pkgdir"/usr/share/licenses/lbe/
    
      43
    
      44  # Launcher
    
      45  install -Dm755 lbe.desktop          "$pkgdir"/usr/share/applications/lbe.desktop
    
      46  install -Dm755 lbe.sh               "$pkgdir"/usr/bin/lbe
    
      47
    
      48  # Customizations
    
      49  {
    
      50    echo
    
      51    echo "# Added by packager"
    
      52    echo "krbextradata=binary"
    
      53    echo "krbprincipalkey=binary"
    
      54  } >> "$pkgdir"/usr/share/lbe/skel/attributes.config
    
      55}
    
      56
    
      57# vim: ts=2:sw=2:et
    
      58

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2