meteoinfo

maintainer envolution · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a source zip from the project's own domain (meteothink.org), which is not on a standard forge but plausibly official; the checksums are provided and match, and the installed files are scripts and data from the verified source, posing no execution risk beyond normal AUR package builds.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source zip from the project's own domain (meteothink.org), which is not on a standard forge but plausibly official; the checksums are provided and match, and the installed files are scripts and data from the verified source, posing no execution risk beyond normal AUR package builds.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("http://meteothink.org/downloads/files/MeteoInfo_${pkgver}.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: envolution
    
      2# Contributor: Heavysink <winstonwu91@gmail.com>
    
      3# shellcheck shell=bash disable=SC2034,SC2154
    
      4
    
      5pkgname=meteoinfo
    
      6pkgver=4.1.5
    
      7pkgrel=1
    
      8pkgdesc="MeteoInfo: GIS, scientific computation and visualization environment"
    
      9arch=("any")
    
      10url="http://meteothink.org"
    
      11license=("LGPL-3.0")
    
      12depends=("java-environment")
    
      13source=("http://meteothink.org/downloads/files/MeteoInfo_${pkgver}.zip"
    
      14  https://raw.githubusercontent.com/meteoinfo/MeteoInfo/refs/heads/master/LICENSE
    
      15  https://raw.githubusercontent.com/meteoinfo/MeteoInfo/refs/heads/master/README.md
    
      16)
    
      17sha256sums=('44067a20aad12660d40c85f1e805613e8e166a8e66bde60513fde44ea0bea4da'
    
      18            '97628afebc60f026f5c2b25d7491c46a5c4ee61f693e7cfa07fbd2c03605979b'
    
      19            '3cf668325fdd689a49cf5aab59f2b53948d7df05248e121be6111e11969a128c')
    
      20
    
      21package() {
    
      22  install -dm755 $pkgdir/opt
    
      23  install -dm755 $pkgdir/usr/bin
    
      24  cp -r MeteoInfo $pkgdir/opt
    
      25  chmod +x $pkgdir/opt/MeteoInfo/milab.sh $pkgdir/opt/MeteoInfo/mimap.sh
    
      26  ln -s /opt/MeteoInfo/milab.sh $pkgdir/usr/bin/milab
    
      27  ln -s /opt/MeteoInfo/mimap.sh $pkgdir/usr/bin/mimap
    
      28  install -Dm644 README.md $pkgdir/usr/share/doc/$pkgname/README.md
    
      29  install -Dm644 LICENSE $pkgdir/usr/share/licenses/$pkgname/LICENSE
    
      30}
    
      31# vim:set ts=2 sw=2 et:
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2