molden

maintainer banana-bred · 7 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a tarball from a university-hosted FTP server that plausibly belongs to the project; building from project-owned infrastructure is normal for AUR packages, even if the host is not whitelisted.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from a university-hosted FTP server that plausibly belongs to the project; building from project-owned infrastructure is normal for AUR packages, even if the host is not whitelisted.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:31 "https://ftp.science.ru.nl/Molden/${pkgname}${pkgver}.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: banana-bred <j.forer@posteo.net>
    
      2pkgname="molden"
    
      3pkgver=7.3
    
      4pkgrel=7
    
      5pkgdesc="A program for molecular and electronic structure visualization"
    
      6arch=('i686' 'x86_64')
    
      7url="https://www.theochem.ru.nl/molden/"
    
      8license=('custom')
    
      9groups=()
    
      10depends=('mesa' 'glu')
    
      11makedepends=(
    
      12    'vi'
    
      13    'gcc-fortran'
    
      14    'xorgproto'
    
      15    'libx11'
    
      16    'makedepend'
    
      17    'libxmu'
    
      18)
    
      19optdepends=(
    
      20   'openbabel: to create 2D images of the molecules in a .sdf file'
    
      21   'wget: to fetch PDB from rcsb.org'
    
      22)
    
      23provides=('molden')
    
      24conflicts=()
    
      25replaces=()
    
      26backup=()
    
      27options=()
    
      28install=
    
      29changelog=
    
      30source=(
    
      31    "https://ftp.science.ru.nl/Molden/${pkgname}${pkgver}.tar.gz"
    
      32)
    
      33noextract=()
    
      34sha256sums=('870f4fa6635229791bb09bbbd07f51456b2c90101d73564dc47ed7769b8c07a1')
    
      35
    
      36prepare() {
    
      37  cd "molden${pkgver}"
    
      38
    
      39  # Patch to compile with gfortran 10+
    
      40  # Original contribution by Panadestein on 5/31/2020
    
      41  sed -i 's/FFLAGS += -g ${AFLAG}/& -fallow-argument-mismatch/g' makefile
    
      42  sed -i 's/FFLAGS = -g ${AFLAG}/& -fallow-argument-mismatch/g' docker/makefile
    
      43
    
      44  # -- use mkstemp instead of mktemp
    
      45  sed -i 's/mktemp/mkstemp/g' src/xwin.c
    
      46
    
      47  # -- ensure Wno-implicit-function-declaration is used to suppress this warning that becomes an error
    
      48  sed -i "106s/^/# /; 109s/^/# /" makefile
    
      49  sed -i "68s/^/# /; 71s/^/# /" docker/makefile
    
      50
    
      51  # -- get the path to the current gcc version to add as an include directory for 'surf'
    
      52  _gccInclude="$(echo "$(dirname "$(gcc -print-prog-name=cc1)")/include" | sed 's/\//\\\//g')"
    
      53
    
      54  # -- update include directories for surf
    
      55  sed -i "s/\(^INCLUDE\s*=\).*/\1 -I .\/ -I ${_gccInclude}/" src/surf/Makefile
    
      56
    
      57}
    
      58
    
      59build() {
    
      60  cd "molden${pkgver}"
    
      61  make -k -j CC="gcc -std=gnu17"
    
      62}
    
      63
    
      64package() {
    
      65  cd "molden${pkgver}"
    
      66  install -t "$pkgdir/usr/bin/"  -Dm755 bin/{molden,gmolden,ambfor,ambmd,surf}
    
      67  install -t "$pkgdir/usr/share/doc/$pkgname" -Dm755 doc/figures.ps.Z  doc/manual.ps.Z doc/manual.txt.Z
    
      68  install -t "$pkgdir/usr/share/licenses/$pkgname/" -Dm755 CopyRight MOLDEN_COMMERCIAL_LICENSE REGISTER
    
      69}
    
      70
    
      71# vim: ts=2 sw=2 et :
    
      72

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2