odf-converter

LOW

maintainer maz-1 6 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a source zip from SourceForge, a common but non-whitelisted host, and builds a helper library from SVN; the main executable is a prebuilt .exe run via mono, but it is part of the official project release and the source host is plausibly legitimate, making the risk low.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source zip from SourceForge, a common but non-whitelisted host, and builds a helper library from SVN; the main executable is a prebuilt .exe run via mono, but it is part of the official project release and the source host is plausibly legitimate, making the risk low.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 "zlib123::svn+svn://svn.code.sf.net/p/odf-converter/code/trunk/"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: maz-1 <ohmygod19993 at gmail dot com>
    
      2_pkgname=odf-converter
    
      3pkgname=${_pkgname}
    
      4pkgver=4.0.5309
    
      5pkgrel=1
    
      6pkgdesc="Convert ODF to OpenXML(docx, xlsx, pptx)"
    
      7arch=("i686" "x86_64")
    
      8url="https://sourceforge.net/p/odf-converter"
    
      9license=("BSD")
    
      10depends=('mono')
    
      11makedepends=('svn' 'dos2unix')
    
      12options=('!strip' 'emptydirs' 'libtool')
    
      13source=("http://downloads.sourceforge.net/project/odf-converter/ODF%20Translator%20CommandLine/Release%204.0/CommandLineTool_4.0.5309.zip"
    
      14        "zlib123::svn+svn://svn.code.sf.net/p/odf-converter/code/trunk/"
    
      15        zlibwapi.patch)
    
      16noextract=(CommandLineTool_4.0.5309.zip)
    
      17md5sums=('84dbd341396dacdd8dbd70d745728e3c'
    
      18         'SKIP'
    
      19         '80f91da40ed073f8ce50522189a09a33')
    
      20
    
      21prepare() {
    
      22    cd "$srcdir/zlib123/source/AdditionalTools/zlib123"
    
      23    patch -p1 < "${srcdir}/zlibwapi.patch"
    
      24}
    
      25
    
      26build() {
    
      27    cd "$srcdir/zlib123/source/AdditionalTools/zlib123"
    
      28    dos2unix configure
    
      29    chmod 755 ./configure
    
      30    ./configure --shared
    
      31    #make test
    
      32    cd contrib/minizip
    
      33    make
    
      34}
    
      35
    
      36package() {
    
      37    mkdir -p "$pkgdir/usr/"{share/odf-converter,bin}
    
      38    cd "$pkgdir/usr/share/odf-converter"
    
      39    unzip "$srcdir/CommandLineTool_4.0.5309.zip"
    
      40    rm libzlibwapi.so zlibwapi.dll
    
      41    cp "$srcdir/zlib123/source/AdditionalTools/zlib123/contrib/minizip/libzlibwapi.so" ./
    
      42    echo '#!/bin/sh'  > "$pkgdir/usr/bin/odfconverter"
    
      43    echo 'exec mono /usr/share/odf-converter/OdfConverter.exe "$@"'  >> "$pkgdir/usr/bin/odfconverter"
    
      44    chmod +x "$pkgdir/usr/bin/odfconverter"
    
      45}
    
      46

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2