nroffedit

maintainer sanerb · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a prebuilt JAR downloaded from aaa-sec.com, which is the project's own official homepage (the url= field points to the same domain). This is not an unofficial or personal host — it is the upstream vendor's own distribution site for NroffEdit, a legitimate IETF/nroff editor tool. The SHA-512 checksums are provided for the ZIP and the two local files (launcher script and license), and PGP signatures are fetched alongside every artifact (validpgpkeys is set). The .sig files have SKIP checksums, which is normal since signatures are verified by content not hash. The only real concern is that the ZIP checksum has an odd length (127 hex chars instead of 128), which may indicate a truncation/typo in the PKGBUILD, but this is a packaging quality issue rather than a security threat. Overall this is a legitimate upstream vendor host with PGP verification in place; the cheaper model's concern about a 'non-standard host' is a false positive since it IS the official project host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 72%): The source is a prebuilt JAR downloaded from aaa-sec.com, which is the project's own official homepage (the url= field points to the same domain). This is not an unofficial or personal host — it is the upstream vendor's own distribution site for NroffEdit, a legitimate IETF/nroff editor tool. The SHA-512 checksums are provided for the ZIP and the two local files (launcher script and license), and PGP signatures are fetched alongside every artifact (validpgpkeys is set). The .sig files have SKIP checksums, which is normal since signatures are verified by content not hash. The only real concern is that the ZIP checksum has an odd length (127 hex chars instead of 128), which may indicate a truncation/typo in the PKGBUILD, but this is a packaging quality issue rather than a security threat. Overall this is a legitimate upstream vendor host with PGP verification in place; the cheaper model's concern about a 'non-standard host' is a false positive since it IS the official project host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("http://aaa-sec.com/pub/${_pkgname}/${_pkgname}Jar${_pkgver}.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: brent s. <bts[at]square-r00t[dot]net>
    
      2validpgpkeys=('748231EBCBD808A14F5E85D28C004C2F93481F6B')
    
      3# Bug reports can be filed at https://bugs.square-r00t.net/index.php?project=3
    
      4# News updates for packages can be followed at https://devblog.square-r00t.net
    
      5pkgname=nroffedit
    
      6pkgver=2.08
    
      7pkgrel=3
    
      8pkgdesc="WYSIWYG Internet-Draft Nroff Editor"
    
      9arch=( 'x86_64' )
    
      10url="http://aaa-sec.com/nroffedit/"
    
      11license=( 'custom' )
    
      12depends=( 'java-runtime' )
    
      13_pkgname=NroffEdit
    
      14_pkgver=${pkgver//./}
    
      15source=("http://aaa-sec.com/pub/${_pkgname}/${_pkgname}Jar${_pkgver}.zip"
    
      16	"${pkgname}"
    
      17	"license"
    
      18        "${_pkgname}Jar${_pkgver}.zip.sig"
    
      19	"${pkgname}.sig"
    
      20	"license.sig")
    
      21sha512sums=('d1afbe6355743ce7af562bb6502b6cfb7184b38e0e8b5d60f3fe98c5ea9f655a994fad4cac91d2e6f93204368afffb8d708fd84e60a67f4e0ab4b584d2404bd6'
    
      22	    '621605b6f6962083804a740dc7d2f45ee042f45d978fe22d4b24543a1b9b9a4dc44e345b42d58f2ec5ac5e940b47d2905f19c346017ad9bc569fb0075e925ba1'
    
      23	    '04f683fb46749ba83b120ddd1e036032a43219d02d6e74b3599b72d5889595594f38165908c193a8adbc2e4b555ed8eae1592953c494d1c46f79bce02b50d9bc'
    
      24            'SKIP'
    
      25	    'SKIP'
    
      26	    'SKIP')
    
      27
    
      28package() {
    
      29	install -d -m0755 ${pkgdir}/usr/share/java/${pkgname}
    
      30	install -d -m0755 ${pkgdir}/usr/share/doc/${pkgname}
    
      31	install -d -m0755 ${pkgdir}/usr/share/licenses/${pkgname}
    
      32	install -d -m0755 ${pkgdir}/usr/bin
    
      33	install -D ${srcdir}/license -m0644 ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
    
      34	install -D -m0755 ${srcdir}/${pkgname} ${pkgdir}/usr/bin/${pkgname}
    
      35	cp -a ${srcdir}/${_pkgname}/* ${pkgdir}/usr/share/java/${pkgname}
    
      36	mv ${pkgdir}/usr/share/java/${pkgname}/README.txt ${pkgdir}/usr/share/doc/${pkgname}/README
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2