masterpdfeditor-qt_include
maintainer ninetailedtori
· 2 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package downloads a prebuilt binary from a non-whitelisted host (code-industry.net), which is the official vendor, but the checksum is fetched dynamically at build time without a fixed fallback, creating a supply-chain risk if the site is compromised.
Triggered rules
MEDIUM
External download from an untrusted host, not in source=()
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:11
_checksum=$(curl 'https://code-industry.net/checksum-information/' | grep -oP '[a-f0-9]{40}(?=.*master-pdf-editor-'"${pkgver}${_patchver}"'-qt5.x86_64-qt_include.tar.gz)')
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:33
source_x86_64=("https://code-industry.net/public/master-pdf-editor-${pkgver}${_patchver}-qt5.x86_64-qt_include.tar.gz")
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt binary from a non-whitelisted host (code-industry.net), which is the official vendor, but the checksum is fetched dynamically at build time without a fixed fallback, creating a supply-chain risk if the site is compromised.
PKGBUILD
2 offending line(s) highlighted
1
# shellcheck disable=SC2034,SC2148,SC2154
2
# Maintainer: Toria <ninetailedtori@uwu.gal>
3
4
_pkgname=masterpdfeditor
5
pkgname=${_pkgname}-qt_include
6
pkgver=5.9.98
7
_patchver='-1'
8
pkgrel=1
9
pkgdesc='A complete solution for viewing, creating and editing PDF files (qt5 version with static-linked qt libs).'
10
url='https://code-industry.net/free-pdf-editor/'
11
_checksum=$(curl 'https://code-industry.net/checksum-information/' | grep -oP '[a-f0-9]{40}(?=.*master-pdf-editor-'"${pkgver}${_patchver}"'-qt5.x86_64-qt_include.tar.gz)')
12
arch=('x86_64')
13
license=('custom')
14
depends=(
15
'libgl'
16
'pkcs11-helper'
17
'sane'
18
'xcb-util-image'
19
'xcb-util-keysyms'
20
'xcb-util-renderutil'
21
'xcb-util-wm'
22
'glibc>=2.28'
23
)
24
makedepends=(
25
'curl'
26
'patchelf'
27
)
28
provides=("${_pkgname}=${pkgver}")
29
conflicts=(
30
"${_pkgname}-qt6"
31
"${_pkgname}-qt5"
32
)
33
source_x86_64=("https://code-industry.net/public/master-pdf-editor-${pkgver}${_patchver}-qt5.x86_64-qt_include.tar.gz")
34
sha1sums_x86_64=("${_checksum% *}")
35
36
package() {
37
install -d "${pkgdir}/{opt,usr/bin}/"
38
cp -a --no-preserve=ownership "master-pdf-editor-${pkgver%%.*}" "${pkgdir}/opt/"
39
40
cd "${pkgdir}/opt/master-pdf-editor-${pkgver%%.*}" || return 1
41
ln -sr "masterpdfeditor${pkgver%%.*}" -t "${pkgdir}/usr/bin/"
42
install -Dm644 "masterpdfeditor${pkgver%%.*}.desktop" -t "${pkgdir}/usr/share/applications/"
43
install -Dm644 'license_en.txt' -t "${pkgdir}/usr/share/licenses/${pkgname}/"
44
patchelf --remove-rpath "masterpdfeditor${pkgver%%.*}"
45
}
46
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 3 |
| 2026-08-02 00:16:08 | MEDIUM | 3 |
| 2026-08-01 00:11:18 | MEDIUM | 3 |
| 2026-07-31 00:14:10 | MEDIUM | 3 |
| 2026-07-30 00:17:23 | MEDIUM | 3 |
| 2026-07-29 00:25:53 | MEDIUM | 3 |
| 2026-07-28 00:07:28 | MEDIUM | 3 |
| 2026-07-27 00:24:32 | MEDIUM | 3 |
| 2026-07-26 00:07:32 | MEDIUM | 3 |
| 2026-07-25 00:13:44 | MEDIUM | 3 |
| 2026-07-24 00:02:28 | MEDIUM | 3 |
| 2026-07-23 00:14:47 | MEDIUM | 3 |
| 2026-07-22 00:29:32 | MEDIUM | 3 |
| 2026-07-21 00:24:15 | MEDIUM | 3 |
| 2026-07-20 00:19:49 | MEDIUM | 3 |
| 2026-07-19 00:17:08 | MEDIUM | 3 |
| 2026-07-18 00:14:48 | MEDIUM | 3 |
| 2026-07-17 00:06:16 | MEDIUM | 3 |
| 2026-07-16 00:05:41 | MEDIUM | 3 |
| 2026-07-15 00:09:25 | MEDIUM | 3 |