masterpdfeditor-qt5

maintainer ninetailedtori · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads checksums dynamically from code-industry.net (the vendor's own domain) at parse time rather than hardcoding them, which is unconventional but not malicious; the actual binaries are fetched from the same vendor domain and verified against those checksums, so the real risk is just that the checksum fetch could fail or be tampered with in transit (no HTTPS MITM protection beyond curl defaults), but there is no obfuscated payload, no third-party swappable host, and no credential exfiltration.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 75%): The package downloads checksums dynamically from code-industry.net (the vendor's own domain) at parse time rather than hardcoding them, which is unconventional but not malicious; the actual binaries are fetched from the same vendor domain and verified against those checksums, so the real risk is just that the checksum fetch could fail or be tampered with in transit (no HTTPS MITM protection beyond curl defaults), but there is no obfuscated payload, no third-party swappable host, and no credential exfiltration.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:14 _checksum_x86_64=$(curl 'https://code-industry.net/checksum-information/' | grep -oP '[a-f0-9]{40}(?=.*master-pdf-editor-'"${pkgver}${_patchver}"'-qt5.x86_64.tar.gz)')
PKGBUILD:15 _checksum_aarch64=$(curl 'https://code-industry.net/checksum-information/' | grep -oP '[a-f0-9]{40}(?=.*master-pdf-editor-'"${pkgver}${_armpatchver}"'-qt5.arm64.tar.gz)')

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:43 source_x86_64=("https://code-industry.net/public/master-pdf-editor-${pkgver}${_patchver}-qt5.x86_64.tar.gz")

PKGBUILD

3 offending line(s) highlighted

      1#!/usr/bin/env bash
    
      2# shellcheck disable=SC2034,SC2148,SC2154
    
      3#
    
      4# Maintainer: Toria <ninetailedtori@uwu.gal>
    
      5#
    
      6_pkgname=masterpdfeditor
    
      7pkgname=${_pkgname}-qt5
    
      8pkgver=5.9.98
    
      9_patchver='-1'
    
      10_armpatchver=''
    
      11pkgrel=1
    
      12pkgdesc='A complete solution for viewing, creating and editing PDF files (qt5 version).'
    
      13url='https://code-industry.net/free-pdf-editor/'
    
      14_checksum_x86_64=$(curl 'https://code-industry.net/checksum-information/' | grep -oP '[a-f0-9]{40}(?=.*master-pdf-editor-'"${pkgver}${_patchver}"'-qt5.x86_64.tar.gz)')
    
      15_checksum_aarch64=$(curl 'https://code-industry.net/checksum-information/' | grep -oP '[a-f0-9]{40}(?=.*master-pdf-editor-'"${pkgver}${_armpatchver}"'-qt5.arm64.tar.gz)')
    
      16arch=(
    
      17    'x86_64'
    
      18    'aarch64'
    
      19)
    
      20license=('custom')
    
      21depends=(
    
      22    'libgl'
    
      23    'pkcs11-helper'
    
      24    'sane'
    
      25    'qt5-base'
    
      26    'qt5-svg'
    
      27    'qt5-declarative'
    
      28    'xcb-util-image'
    
      29    'xcb-util-keysyms'
    
      30    'xcb-util-renderutil'
    
      31    'xcb-util-wm'
    
      32    'glibc>=2.28'
    
      33)
    
      34makedepends=(
    
      35    'curl'
    
      36    'patchelf'
    
      37)
    
      38provides=("${_pkgname}=${pkgver}")
    
      39conflicts=(
    
      40    "${_pkgname}-qt_include"
    
      41    "${_pkgname}-qt6"
    
      42)
    
      43source_x86_64=("https://code-industry.net/public/master-pdf-editor-${pkgver}${_patchver}-qt5.x86_64.tar.gz")
    
      44sha1sums_x86_64=("${_checksum_x86_64% *}")
    
      45source_aarch64=("https://code-industry.net/public/master-pdf-editor-${pkgver}${_patchver}-qt5.arm64.tar.gz")
    
      46sha1sums_aarch64=("${_checksum_aarch64% *}")
    
      47
    
      48package() {
    
      49    install -d "${pkgdir}/{opt,usr/bin}/"
    
      50    cp -a --no-preserve=ownership "master-pdf-editor-${pkgver%%.*}" "${pkgdir}/opt/"
    
      51
    
      52    cd                      "${pkgdir}/opt/master-pdf-editor-${pkgver%%.*}" || return 1
    
      53    ln -sr                  "${_pkgname}${pkgver%%.*}"          -t "${pkgdir}/usr/bin/"
    
      54    install -Dm644          "${_pkgname}${pkgver%%.*}.desktop"  -t "${pkgdir}/usr/share/applications/"
    
      55    install -Dm644          'license_en.txt'                    -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      56    patchelf --remove-rpath "${_pkgname}${pkgver%%.*}"
    
      57}
    
      58

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3