matlab-mpm

maintainer vitaliikuzhdin · 6 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package downloads a prebuilt binary from mathworks.com (a trusted vendor domain) for installation, which is normal for official binaries; the non-whitelisted host is actually a subdomain of mathworks.com used for support/downloads, making it legitimate.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from mathworks.com (a trusted vendor domain) for installation, which is normal for official binaries; the non-whitelisted host is actually a subdomain of mathworks.com used for support/downloads, making it legitimate.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:41 "${pkgname}-${_pkgver}-x86_64::https://ssd.mathworks.com/supportfiles/downloads/${_name}/${_pkgver}/glnxa64/${_name}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
    
      2
    
      3_name="mpm"
    
      4pkgname="matlab-${_name}"
    
      5_commit="33346eb7e577e6405fd349faff6efd98ae98b1d4"
    
      6pkgver=2026.5.1+r154.g33346eb
    
      7_pkgver="${pkgver%+*}"
    
      8pkgrel=1
    
      9epoch=1
    
      10pkgdesc="MATLAB Package Manager"
    
      11arch=(
    
      12  'x86_64' # glnxa64
    
      13)
    
      14url="https://www.mathworks.com/products/mpm.html"
    
      15_url="https://github.com/mathworks-ref-arch/matlab-dockerfile"
    
      16license=(
    
      17  'custom:MATLAB EULA'
    
      18)
    
      19depends=(
    
      20  'glibc'
    
      21
    
      22  # https://www.mathworks.com/help/install/ug/get-mpm-os-command-line.html
    
      23  'ca-certificates'
    
      24  'unzip'
    
      25
    
      26  # https://github.com/mathworks-ref-arch/container-images/commit/ea7154f8f2b3efa2bcbaded5ba151285a0281c2e
    
      27  # https://github.com/mathworks-ref-arch/matlab-dockerfile/issues/160
    
      28  'libatomic'
    
      29)
    
      30makedepends=(
    
      31  'git'
    
      32)
    
      33optdepends=(
    
      34  "${pkgname}-input: input files used with '--inputfile'"
    
      35)
    
      36_pkgsrc="${_url##*/}"
    
      37source=(
    
      38  "${_pkgsrc}::git+${_url}.git#commit=${_commit}"
    
      39)
    
      40source_x86_64=(
    
      41  "${pkgname}-${_pkgver}-x86_64::https://ssd.mathworks.com/supportfiles/downloads/${_name}/${_pkgver}/glnxa64/${_name}"
    
      42)
    
      43sha256sums=('ce7101146ef13659dfaaf97d1c278a2c1bc3bdb40c587a906b4538546796ee91')
    
      44sha256sums_x86_64=('9e4844334d044468dc1f54ea8a0f7085d04086d3c2e58ba535d2c5dc5a5e78a4')
    
      45
    
      46prepare() {
    
      47  # comment out after updating _commit
    
      48  if [[ "${pkgver}" == "${_pkgver}+r0.updateme" ]]; then
    
      49    echo " -> ERROR: Maitainer, please update the git commit hash!"
    
      50    exit 1
    
      51  fi
    
      52}
    
      53
    
      54pkgver() {
    
      55  cd "${srcdir}/${_pkgsrc}"
    
      56  printf '%s+r%s.g%s' "${_pkgver}" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      57}
    
      58
    
      59package() {
    
      60  cd "${srcdir}"
    
      61  install -vDm755 "${pkgname}-${_pkgver}-${CARCH}" "${pkgdir}/usr/bin/${pkgname}"
    
      62
    
      63  cd "${_pkgsrc}"
    
      64  install -vDm644 "MPM.md"     "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      65  install -vDm644 "LICENSE.md" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.md"
    
      66
    
      67  # https://kdeldycke.github.io/meta-package-manager/
    
      68  # ln -vsf "${pkgname}" "${pkgdir}/usr/bin/${_name}"
    
      69}
    
      70

Changes since previous scan

--- PKGBUILD @ 2026-06-20 16:03
+++ PKGBUILD @ 2026-08-18 00:03
@@ -2,8 +2,8 @@
 
 _name="mpm"
 pkgname="matlab-${_name}"
-_commit="87963d3693f25908716f50547d727886f9d878c8"
-pkgver=2026.4+r147.g87963d3
+_commit="33346eb7e577e6405fd349faff6efd98ae98b1d4"
+pkgver=2026.5.1+r154.g33346eb
 _pkgver="${pkgver%+*}"
 pkgrel=1
 epoch=1
@@ -40,8 +40,8 @@
 source_x86_64=(
   "${pkgname}-${_pkgver}-x86_64::https://ssd.mathworks.com/supportfiles/downloads/${_name}/${_pkgver}/glnxa64/${_name}"
 )
-sha256sums=('d8c51f76f25797a0a7fd12358dee0d4ffb9547482d17a03b10264291644cb4fb')
-sha256sums_x86_64=('49f23b8a9b60a7a655c790dadb4703f23c0cbb9a921096e73bda01d3f63884a9')
+sha256sums=('ce7101146ef13659dfaaf97d1c278a2c1bc3bdb40c587a906b4538546796ee91')
+sha256sums_x86_64=('9e4844334d044468dc1f54ea8a0f7085d04086d3c2e58ba535d2c5dc5a5e78a4')
 
 prepare() {
   # comment out after updating _commit

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 13:29:16	MEDIUM	1
2026-06-20 16:03:41	CLEAN	2
2026-06-20 00:50:07	MEDIUM	2
2026-06-20 00:18:46	MEDIUM	1
2026-06-19 23:51:18	MEDIUM	2
2026-06-19 19:07:35	LOW	2
2026-06-18 16:11:54	MEDIUM	1