ltspice

maintainer fenugrec · 39 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt MSI installer from Analog Devices' official domain (ltspice.analog.com), which is the project's legitimate source; despite the non-whitelisted host, this is a normal and expected source for the software, and the installer is verified via a hardcoded SHA-256 checksum.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt MSI installer from Analog Devices' official domain (ltspice.analog.com), which is the project's legitimate source; despite the non-whitelisted host, this is a normal and expected source for the software, and the installer is verified via a hardcoded SHA-256 checksum.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:32 "LTspice64-${pkgver}.msi::https://LTspice.analog.com/download/26.0.2/LTspice64.msi"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: fenugrec <fenugrec users sourceforge net>
    
      2# Contributor: Max Stabel <max dot stabel03 at gmail dot com>
    
      3
    
      4# So, versioning is a bit of a mess now. Maybe it will improve over time.
    
      5# - we have a 'maintainer.sh' script to automate version bumping, that retrieves an 'udpate.txt' file from Analog
    
      6# - there are permalinks, like https://ltspice.analog.com/download/24.1.0/LTspice64.msi
    
      7# - the generic URL https://ltspice.analog.com/software/LTspice64.msi links to the 'latest' version
    
      8# - 'LTspice.json' contains version string '24.0.12' (wasn't updated ?), but the .exe shows the expected 24.1.0 
    
      9# - if you download https://ltspice.analog.com/download/24.0.12/LTspice64.msi, you get a file that self-describes as 24.0.11...
    
      10# - it would be possible to process the .exe to extract a version string but I don't see the point.
    
      11
    
      12pkgname=ltspice
    
      13pkgver=26.0.2.1
    
      14pkgrel=1
    
      15pkgdesc="SPICE simulator, schematic capture and waveform viewer."
    
      16arch=('x86_64')
    
      17url="https://www.analog.com/en/resources/design-tools-and-calculators/ltspice-simulator.html"
    
      18license=('LicenseRef-LTspice')
    
      19depends=('wine')
    
      20optdepends=('xdg-utils: for launching HTML help files')
    
      21makedepends=('gawk'
    
      22	'curl'
    
      23	'icoutils'
    
      24	'imagemagick'
    
      25	'msitools'
    
      26)
    
      27
    
      28source=("${pkgname}.sh"
    
      29        "${pkgname}-help.sh"
    
      30	"conv.sh"
    
      31	"ltspice.desktop"
    
      32	"LTspice64-${pkgver}.msi::https://LTspice.analog.com/download/26.0.2/LTspice64.msi"
    
      33	)
    
      34
    
      35installer_sha256='485DABD2D7D8293DE733A399719F6538EFDA4A54B48B181A14E07271186984D3'
    
      36
    
      37sha256sums=('78f50fd44506093849421ec3c05516eba1d850160192175c4e7db4811df40f1c'
    
      38            '3a0fed134c263a7a0573f36c1f4e49d27bea2cca0c098e069e79e1411d3c302e'
    
      39            '9d1eb3d868376960050469324f8c7e7fbf674bfcbcac76c2a10934dbe77f6b6c'
    
      40            'a8b97e57c3fc33b856d45d8e93f38a84f825938dc461a40957ea0f56464d21ee'
    
      41            ${installer_sha256}
    
      42    )
    
      43
    
      44options=(!strip)
    
      45
    
      46prepare() {
    
      47    cd "${srcdir}"
    
      48
    
      49    msiextract LTspice64-${pkgver}.msi
    
      50    mv -f "APPDIR:."/* .
    
      51    mv -f "LocalAppDataFolder/LTspice"/* .
    
      52}
    
      53
    
      54build() {
    
      55    cd "${srcdir}"
    
      56
    
      57    wrestool -x -t 14 LTspice.exe >${pkgname}.ico
    
      58    magick ${pkgname}.ico ${pkgname}.png
    
      59    rm ${pkgname}.ico
    
      60
    
      61    #tweak mixed-case hyperlinks in help docs
    
      62    cd LTspiceHelp
    
      63    echo '==> Adjusting help files'
    
      64    sh ../conv.sh
    
      65}
    
      66
    
      67package()
    
      68{
    
      69    cd "${srcdir}"
    
      70
    
      71    # Install License
    
      72    install -Dm644 License.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      73
    
      74    # Install Desktop file
    
      75    install -Dm644 "${pkgname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      76    install -Dm644 "${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      77
    
      78    # Install docs
    
      79    install -m755 -d "${pkgdir}/usr/share/doc/${pkgname}"
    
      80    cp -r LTspiceHelp/* "${pkgdir}/usr/share/doc/${pkgname}"
    
      81
    
      82    # Install program files, following
    
      83    # https://wiki.archlinux.org/title/Wine_package_guidelines
    
      84    bin_destdir="${pkgdir}/usr/share/${pkgname}"
    
      85    install -m755 -d "${bin_destdir}"
    
      86    install -m755 *.exe "${bin_destdir}"
    
      87    install -m644 *.zip "${bin_destdir}"
    
      88    install -m644 LTspice.json "${bin_destdir}"
    
      89    install -m644 ChangeLog.txt "${bin_destdir}"
    
      90
    
      91    # symlink help files
    
      92    ln -sv "/usr/share/doc/${pkgname}" "${bin_destdir}/LTspiceHelp"
    
      93
    
      94    # Install /usr/bin startscript
    
      95    install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      96    install -Dm755 "${srcdir}/${pkgname}-help.sh" "${pkgdir}/usr/bin/${pkgname}-help"
    
      97}
    
      98
    
      99

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2