lrz-syncshare
maintainer SaberanMarcross
· 5 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads the official source tarball and checksum from the LRZ (Leibniz Supercomputing Centre) internal domains, which are plausible for the project's official infrastructure; the build process only modifies paths in scripts and installs them locally, with no evidence of malicious or unverifiable code execution.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads the official source tarball and checksum from the LRZ (Leibniz Supercomputing Centre) internal domains, which are plausible for the project's official infrastructure; the build process only modifies paths in scripts and installs them locally, with no evidence of malicious or unverifiable code execution.
2 higher static findings superseded - not the current verdict (shown for transparency)
MEDIUM
External download from an untrusted host, not in source=()
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:14
sha256sums=("$(curl -s https://sasrepo.nas.lrz.de/SHA256SUMS.txt | grep LRZ_Sync_Share_v${pkgver}_Linux.tar.gz | head -n 1 | cut -d ' ' -f 1)")
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:13
source=("LRZ_Sync_Share_v${pkgver}_Linux.tar.gz::https://tgz.sasrepo.nas.lrz.de/${branch}/LRZ_Sync_Share_v${pkgver}_Linux.tar.gz")
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: André Schamschurko <marcrosssaberan[AT]gmail[DOT]com>
2
# Contributer: Andreas Born <futur[DOT]andy[AT]googlemail[DOT]com>
3
4
branch=stable
5
pkgname=lrz-syncshare
6
pkgver=26.2.114
7
pkgrel=1
8
pkgdesc="Sync client for the LRZ Sync+Share service"
9
url='https://syncandshare.lrz.de/'
10
arch=('any')
11
license=('custom')
12
depends=('desktop-file-utils' 'hicolor-icon-theme' 'java-runtime>=15' 'xdg-utils' 'archlinux-java-run')
13
source=("LRZ_Sync_Share_v${pkgver}_Linux.tar.gz::https://tgz.sasrepo.nas.lrz.de/${branch}/LRZ_Sync_Share_v${pkgver}_Linux.tar.gz")
14
sha256sums=("$(curl -s https://sasrepo.nas.lrz.de/SHA256SUMS.txt | grep LRZ_Sync_Share_v${pkgver}_Linux.tar.gz | head -n 1 | cut -d ' ' -f 1)")
15
pkgver() {
16
cat "${srcdir}/LRZ_Sync_Share/VERSION" | sed -e 's/\s*$//'
17
}
18
19
prepare() {
20
cd "${srcdir}/LRZ_Sync_Share"
21
22
sed -e "s;^CLIENT_INSTALL=.*\$;CLIENT_INSTALL=/usr/share/${pkgname};" \
23
-e 's;^RUN_CMD="$CLIENT_INSTALL/jre/bin/java ;RUN_CMD="/usr/bin/archlinux-java-run -a 15 -- ;' \
24
-i LRZ_Sync_Share-Client.sh
25
sed -e "s;^Icon=.*;Icon=${pkgname};" \
26
-e "s;^Exec=.*;Exec=${pkgname};" -i install-files/LRZ_Sync_Share.desktop
27
}
28
29
package() {
30
cd "${srcdir}/LRZ_Sync_Share"
31
32
install -Dm755 LRZ_Sync_Share-Client.sh "${pkgdir}/usr/bin/${pkgname}"
33
install -Dm644 LRZ_Sync_Share.jar -t "${pkgdir}/usr/share/${pkgname}/"
34
35
install -Dm644 install-files/LRZ_Sync_Share.desktop "${pkgdir}/usr/share/applications/${pkgname}.desktop"
36
install -Dm644 install-files/LRZ_Sync_Share.png "${pkgdir}/usr/share/icons/hicolor/128x128/apps/${pkgname}.png"
37
38
install -D -m644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
39
}
40
41
Changes since previous scan
--- PKGBUILD @ 2026-07-17 00:06+++ PKGBUILD @ 2026-08-03 00:08@@ -3,7 +3,7 @@ branch=stable pkgname=lrz-syncshare-pkgver=26.1.100+pkgver=26.2.114 pkgrel=1 pkgdesc="Sync client for the LRZ Sync+Share service" url='https://syncandshare.lrz.de/'Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 3 |
| 2026-08-02 00:16:08 | LOW | 3 |
| 2026-08-01 00:11:18 | LOW | 3 |
| 2026-07-31 00:14:10 | LOW | 3 |
| 2026-07-30 00:17:23 | LOW | 3 |
| 2026-07-29 00:25:53 | LOW | 3 |
| 2026-07-28 00:07:28 | LOW | 3 |
| 2026-07-27 00:24:32 | LOW | 3 |
| 2026-07-26 00:07:32 | LOW | 3 |
| 2026-07-25 00:13:44 | LOW | 3 |
| 2026-07-24 00:02:28 | LOW | 3 |
| 2026-07-23 00:14:47 | LOW | 3 |
| 2026-07-22 00:29:32 | LOW | 3 |
| 2026-07-21 00:24:15 | LOW | 3 |
| 2026-07-20 00:19:49 | LOW | 3 |
| 2026-07-19 00:17:08 | LOW | 3 |
| 2026-07-18 00:14:48 | LOW | 3 |
| 2026-07-17 23:55:59 | MEDIUM | 2 |
| 2026-07-17 00:06:16 | LOW | 3 |
| 2026-07-16 00:05:41 | LOW | 3 |