logicdraw

maintainer PWN1109 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The JAR is downloaded from a personal CI server (ci.wieku.me) rather than a GitHub release or other canonical upstream host. A JAR is executed code (run by the JVM), so a silently swapped artifact on that server would result in arbitrary code execution. The URL construction using shell command substitution (`$(echo $pkgver|cut -d'.' -f3)`) is unusual but not obfuscated — it extracts the patch version number to form the Jenkins build number path. The md5sum provides only weak integrity assurance (MD5 is broken for collision resistance). There is no GPG signature verification. The concern is real: a personal CI server is not a trustworthy, stable artifact host, and the artifact is executable. This is a genuine medium-severity supply-chain concern, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=("https://ci.wieku.me/job/LogicDraw/$(echo $pkgver|cut -d"." -f3)/artifact/desktop/build/libs/LogicDraw-$pkgver.jar"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The JAR is downloaded from a personal CI server (ci.wieku.me) rather than a GitHub release or other canonical upstream host. A JAR is executed code (run by the JVM), so a silently swapped artifact on that server would result in arbitrary code execution. The URL construction using shell command substitution (`$(echo $pkgver|cut -d'.' -f3)`) is unusual but not obfuscated — it extracts the patch version number to form the Jenkins build number path. The md5sum provides only weak integrity assurance (MD5 is broken for collision resistance). There is no GPG signature verification. The concern is real: a personal CI server is not a trustworthy, stable artifact host, and the artifact is executable. This is a genuine medium-severity supply-chain concern, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kacper Łukawski <kacluk98@gmail.com>
    
      2pkgname=logicdraw
    
      3pkgver=0.1.13
    
      4pkgrel=1
    
      5pkgdesc="An application to perform simulations of logic gates, in which you can paint your circuit like in raster graphics editor."
    
      6arch=('any')
    
      7url="https://github.com/Wieku/LogicDraw"
    
      8license=('MIT')
    
      9depends=('java-runtime' 'libgl')
    
      10source=("https://ci.wieku.me/job/LogicDraw/$(echo $pkgver|cut -d"." -f3)/artifact/desktop/build/libs/LogicDraw-$pkgver.jar"
    
      11  "logicdraw"
    
      12  "logicdraw.desktop" )
    
      13noextract=()
    
      14md5sums=('dbaac2868e967a6c960302424bc066b9'
    
      15         'dbc0616e552aca3bcc4781fefdceea04'
    
      16         'a4c84914036108b15892e2c60a36066f')
    
      17validpgpkeys=()
    
      18conflicts=('logicdraw')
    
      19provides=('logicdraw')
    
      20
    
      21package() {
    
      22  cd "$srcdir"
    
      23
    
      24  install -d "$pkgdir"/usr/{bin,share/logicdraw}
    
      25  install "$srcdir"/logicdraw "$pkgdir"/usr/bin/
    
      26  install -D -m644 "$srcdir"/logicdraw.desktop "$pkgdir"/usr/share/applications/logicdraw.desktop
    
      27  mv -f LogicDraw-$pkgver.jar "$pkgdir"/usr/share/logicdraw/logicdraw.jar
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2