lrz-syncshare

maintainer SaberanMarcross · 5 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The package downloads the official source tarball and checksum from the LRZ (Leibniz Supercomputing Centre) internal domains, which are plausible for the project's official infrastructure; the build process only modifies paths in scripts and installs them locally, with no evidence of malicious or unverifiable code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads the official source tarball and checksum from the LRZ (Leibniz Supercomputing Centre) internal domains, which are plausible for the project's official infrastructure; the build process only modifies paths in scripts and installs them locally, with no evidence of malicious or unverifiable code execution.

2 higher static findings superseded - not the current verdict (shown for transparency)
MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

  • PKGBUILD:14 sha256sums=("$(curl -s https://sasrepo.nas.lrz.de/SHA256SUMS.txt | grep LRZ_Sync_Share_v${pkgver}_Linux.tar.gz | head -n 1 | cut -d ' ' -f 1)")
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:13 source=("LRZ_Sync_Share_v${pkgver}_Linux.tar.gz::https://tgz.sasrepo.nas.lrz.de/${branch}/LRZ_Sync_Share_v${pkgver}_Linux.tar.gz")

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: André Schamschurko <marcrosssaberan[AT]gmail[DOT]com>
2# Contributer: Andreas Born <futur[DOT]andy[AT]googlemail[DOT]com>
3
4branch=stable
5pkgname=lrz-syncshare
6pkgver=26.2.114
7pkgrel=1
8pkgdesc="Sync client for the LRZ Sync+Share service"
9url='https://syncandshare.lrz.de/'
10arch=('any')
11license=('custom')
12depends=('desktop-file-utils' 'hicolor-icon-theme' 'java-runtime>=15' 'xdg-utils' 'archlinux-java-run')
13source=("LRZ_Sync_Share_v${pkgver}_Linux.tar.gz::https://tgz.sasrepo.nas.lrz.de/${branch}/LRZ_Sync_Share_v${pkgver}_Linux.tar.gz")
14sha256sums=("$(curl -s https://sasrepo.nas.lrz.de/SHA256SUMS.txt | grep LRZ_Sync_Share_v${pkgver}_Linux.tar.gz | head -n 1 | cut -d ' ' -f 1)")
15pkgver() {
16 cat "${srcdir}/LRZ_Sync_Share/VERSION" | sed -e 's/\s*$//'
17}
18
19prepare() {
20 cd "${srcdir}/LRZ_Sync_Share"
21
22 sed -e "s;^CLIENT_INSTALL=.*\$;CLIENT_INSTALL=/usr/share/${pkgname};" \
23 -e 's;^RUN_CMD="$CLIENT_INSTALL/jre/bin/java ;RUN_CMD="/usr/bin/archlinux-java-run -a 15 -- ;' \
24 -i LRZ_Sync_Share-Client.sh
25 sed -e "s;^Icon=.*;Icon=${pkgname};" \
26 -e "s;^Exec=.*;Exec=${pkgname};" -i install-files/LRZ_Sync_Share.desktop
27}
28
29package() {
30 cd "${srcdir}/LRZ_Sync_Share"
31
32 install -Dm755 LRZ_Sync_Share-Client.sh "${pkgdir}/usr/bin/${pkgname}"
33 install -Dm644 LRZ_Sync_Share.jar -t "${pkgdir}/usr/share/${pkgname}/"
34
35 install -Dm644 install-files/LRZ_Sync_Share.desktop "${pkgdir}/usr/share/applications/${pkgname}.desktop"
36 install -Dm644 install-files/LRZ_Sync_Share.png "${pkgdir}/usr/share/icons/hicolor/128x128/apps/${pkgname}.png"
37
38 install -D -m644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
39}
40
41

Changes since previous scan

--- PKGBUILD @ 2026-07-17 00:06
+++ PKGBUILD @ 2026-08-03 00:08
@@ -3,7 +3,7 @@
branch=stable
pkgname=lrz-syncshare
-pkgver=26.1.100
+pkgver=26.2.114
pkgrel=1
pkgdesc="Sync client for the LRZ Sync+Share service"
url='https://syncandshare.lrz.de/'

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 3
2026-08-02 00:16:08 LOW 3
2026-08-01 00:11:18 LOW 3
2026-07-31 00:14:10 LOW 3
2026-07-30 00:17:23 LOW 3
2026-07-29 00:25:53 LOW 3
2026-07-28 00:07:28 LOW 3
2026-07-27 00:24:32 LOW 3
2026-07-26 00:07:32 LOW 3
2026-07-25 00:13:44 LOW 3
2026-07-24 00:02:28 LOW 3
2026-07-23 00:14:47 LOW 3
2026-07-22 00:29:32 LOW 3
2026-07-21 00:24:15 LOW 3
2026-07-20 00:19:49 LOW 3
2026-07-19 00:17:08 LOW 3
2026-07-18 00:14:48 LOW 3
2026-07-17 23:55:59 MEDIUM 2
2026-07-17 00:06:16 LOW 3
2026-07-16 00:05:41 LOW 3

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion