offsetexplorer

maintainer zayatura · 6 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a shell script installer from the official project domain (kafkatool.com), which is used to install a Java-based Kafka tool; the script is executed locally and not obfuscated, and the final installed files are verified via checksums, posing low risk despite the non-whitelisted host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a shell script installer from the official project domain (kafkatool.com), which is used to install a Java-based Kafka tool; the script is executed locally and not obfuscated, and the final installed files are verified via checksums, posing low risk despite the non-whitelisted host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("https://www.kafkatool.com/download3/offsetexplorer.sh" "set-envs.sh")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zayatura <zayatura@mailbox.org>
    
      2# Contributor: invade_r
    
      3
    
      4pkgname=offsetexplorer
    
      5pkgver=3.0.3
    
      6pkgrel=1
    
      7epoch=
    
      8pkgdesc="The Ultimate UI Tool for Kafka"
    
      9arch=("x86_64")
    
      10url="http://www.kafkatool.com"
    
      11license=('custom')
    
      12groups=()
    
      13depends=('java-runtime=11')
    
      14makedepends=('expect' 'gendesk')
    
      15checkdepends=()
    
      16optdepends=()
    
      17provides=()
    
      18conflicts=()
    
      19replaces=()
    
      20backup=()
    
      21options=()
    
      22install=
    
      23changelog=
    
      24source=("https://www.kafkatool.com/download3/offsetexplorer.sh" "set-envs.sh")
    
      25noextract=("offsetexplorer.sh")
    
      26sha256sums=(
    
      27  '62a8f6f9dd54a0f433bc0317c6638bc69616c26d3b4caf54858e3eb8448b9c5b' # offsetexplorer.sh
    
      28  '65589eea4f00bbbf17bad0e6f69cb56461bac06de1c5e55af24a284d70213430' # set-envs.sh
    
      29)
    
      30validpgpkeys=()
    
      31
    
      32package() {
    
      33  install -dm 755 "$pkgdir/opt/offsetexplorer"
    
      34  install -dm 755 "$pkgdir/usr/bin"
    
      35  echo -e "#!/bin/bash\n/bin/bash -c \"DISPLAY='' $srcdir/offsetexplorer.sh\"" >$srcdir/install.sh
    
      36  chmod +x $srcdir/install.sh
    
      37  chmod +x $srcdir/offsetexplorer.sh
    
      38  chmod +x $srcdir/set-envs.sh
    
      39
    
      40  EXPECT="#!/usr/bin/expect -f
    
      41
    
      42
    
      43set timeout -1
    
      44exp_internal 1
    
      45spawn $srcdir/install.sh
    
      46match_max 100000
    
      47expect \"This will install Offset Explorer 3 on your computer.\r\n\"
    
      48expect \"\[OK (o)\]*\[Cancel\]*\"
    
      49send -- \"o\r\"
    
      50
    
      51#expect \"A previous installation has been detected. Do you wish to update that installation?\"
    
      52#expect \"Yes, update the existing installation \[1, Enter\]\r\"
    
      53#expect \"No, install into a different directory \[2\]\r\"
    
      54
    
      55#send -- \"2\r\"
    
      56
    
      57expect {
    
      58    \"I accept the agreement\" {
    
      59      expect \"Yes*\[1]*No*\[2\]\"
    
      60      send \"1\r\"
    
      61    }
    
      62    \"\[Enter\]\r\" {
    
      63      send \"\r\"
    
      64      exp_continue
    
      65    }
    
      66    default  { exit 1 }
    
      67  }
    
      68
    
      69expect \"Where should Offset Explorer 3 be installed?*\]\r\"
    
      70send -- \"$pkgdir/opt/offsetexplorer\r\"
    
      71expect \"already exists. Would you like to install to that directory anyway?\"
    
      72expect \"Yes*\[y, Enter\]*No*\[n\]\"
    
      73send -- \"y\r\"
    
      74expect \"Create symlinks?\"
    
      75expect \"Yes*\[y, Enter\]*No*\[n\]\"
    
      76send -- \"n\r\"
    
      77expect eof
    
      78"
    
      79
    
      80  echo "$EXPECT" | /bin/expect
    
      81
    
      82  sed -i -E 's_#!/bin/sh_#!/bin/sh\n\nsource /opt/offsetexplorer/set-envs.sh_' $pkgdir/opt/offsetexplorer/offsetexplorer
    
      83
    
      84  cp $srcdir/set-envs.sh $pkgdir/opt/offsetexplorer/set-envs.sh
    
      85
    
      86  ln -s /opt/offsetexplorer/offsetexplorer $pkgdir/usr/bin/offsetexplorer
    
      87
    
      88  gendesk -n --pkgname "$pkgname" --pkgdesc "$pkgdesc"
    
      89  install -Dm644 "$pkgname.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      90  install -Dm644 "$pkgdir/opt/offsetexplorer/.install4j/offsetexplorer.png" "$pkgdir/usr/share/pixmaps/offsetexplorer.png"
    
      91}
    
      92

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2