lenskit

maintainer tikrass · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged Bintray.com was a legitimate JFrog-operated artifact hosting service (now discontinued/redirected). The source is a versioned release tarball with an md5sum check. The package installs JARs and shell scripts from the tarball plus two locally-included wrapper scripts. The 'eval' flag at line 50 is not present in this PKGBUILD — the cheaper model may have hallucinated or confused it with another file. The bintray.com domain is defunct but the md5sum provides integrity verification for the specific artifact. The two wrapper scripts (lenskit, lenskit-eval) are included directly in the source array with checksums, so their content is pinned. No executed binaries are pulled from unofficial personal hosts; this is a standard Java application packaging pattern. The main concern is that bintray.com is gone and the URL will simply fail to resolve, making this broken in practice, but there is no active supply-chain threat. Rating low rather than medium because: (1) bintray was an official, widely-used artifact host (not a personal/unofficial host), (2) checksums are present, (3) no eval of untrusted input exists in this PKGBUILD.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): Bintray.com was a legitimate JFrog-operated artifact hosting service (now discontinued/redirected). The source is a versioned release tarball with an md5sum check. The package installs JARs and shell scripts from the tarball plus two locally-included wrapper scripts. The 'eval' flag at line 50 is not present in this PKGBUILD — the cheaper model may have hallucinated or confused it with another file. The bintray.com domain is defunct but the md5sum provides integrity verification for the specific artifact. The two wrapper scripts (lenskit, lenskit-eval) are included directly in the source array with checksums, so their content is pinned. No executed binaries are pulled from unofficial personal hosts; this is a standard Java application packaging pattern. The main concern is that bintray.com is gone and the URL will simply fail to resolve, making this broken in practice, but there is no active supply-chain threat. Rating low rather than medium because: (1) bintray was an official, widely-used artifact host (not a personal/unofficial host), (2) checksums are present, (3) no eval of untrusted input exists in this PKGBUILD.

PKGBUILD:50 install -Dm755 lenskit-eval "${pkgdir}${_apphome}/bin/lenskit-eval"

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=(https://dl.bintray.com/${pkgname}/${pkgname}-releases/${pkgname}-${pkgver}.tgz

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Thibaud Kehler <Thibaud dot Kehler at gmx dot net>
    
      2
    
      3pkgname=lenskit
    
      4pkgver=2.2.1
    
      5pkgrel=1
    
      6pkgdesc="An open source toolkit for building, researching, and studying recommender systems."
    
      7arch=('any')
    
      8url="http://lenskit.org/"
    
      9license=('LGPL')
    
      10depends=('bash' 'java-runtime-headless')
    
      11
    
      12source=(https://dl.bintray.com/${pkgname}/${pkgname}-releases/${pkgname}-${pkgver}.tgz
    
      13		lenskit
    
      14		lenskit-eval)
    
      15md5sums=('e453d071c857d276aef7149b3efd3561'
    
      16         'd0b13f1da93d38c7d91a7910f792c664'
    
      17         'dbeaa442d3e0df2de066d7b2594f9c58')
    
      18
    
      19package() {
    
      20    cd "${srcdir}/${pkgname}-${pkgver}"
    
      21	_apphome=/usr/share/java/${pkgname}
    
      22	#Jar-files
    
      23	for jar in $(find lib -name "*.jar"); do
    
      24        install -Dm644 "${jar}" "${pkgdir}${_apphome}/${jar}"
    
      25    done
    
      26
    
      27	#Licence
    
      28    install -Dm644 LICENSE.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      29	
    
      30	cd man
    
      31	
    
      32	#Man (1)
    
      33	for man in $(find -name "*.1"); do
    
      34		install -Dm644 "${man}" "${pkgdir}/usr/share/man/man1/${man}"
    
      35	done
    
      36
    
      37	#Man (7)
    
      38	for man in $(find -name "*.7"); do
    
      39		install -Dm644 "${man}" "${pkgdir}/usr/share/man/man7/${man}"
    
      40	done
    
      41	cd ..
    
      42
    
      43	mkdir -p "${pkgdir}/usr/share/doc/lenskit"
    
      44	cp -r javadoc "${pkgdir}/usr/share/doc/lenskit/"
    
      45	
    
      46	cd "${srcdir}" 
    
      47	
    
      48	#Binaries
    
      49	install -Dm755 lenskit "${pkgdir}${_apphome}/bin/lenskit"
    
      50	install -Dm755 lenskit-eval "${pkgdir}${_apphome}/bin/lenskit-eval"
    
      51	mkdir -p "${pkgdir}/usr/bin"
    
      52	ln -s "${_apphome}/bin/lenskit" "${pkgdir}/usr/bin/lenskit"
    
      53	ln -s "${_apphome}/bin/lenskit-eval" "${pkgdir}/usr/bin/lenskit-eval"
    
      54}
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2