oorexx

MEDIUM

maintainer mpento 1 votes scanned 2026-11-01 14:00:44.307000

View on AUR

Why flagged

The package installs a prebuilt Debian binary from SourceForge without a clear upstream build process, posing a supply-chain risk due to unverifiable origin and potential for silent replacement.

Triggered rules

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package installs a prebuilt Debian binary from SourceForge without a clear upstream build process, posing a supply-chain risk due to unverifiable origin and potential for silent replacement.

PKGBUILD

      1# Maintainer: sardo <sardonimous@hotmail.com>
    
      2pkgname=oorexx
    
      3pkgver=5.0.0
    
      4pkgrel=12583
    
      5pkgdesc="open source implementation of Object Rexx"
    
      6arch=('x86_64')
    
      7url="https://sourceforge.net/projects/oorexx/"
    
      8license=('CPL')
    
      9depends=('bash' 'gcc-libs-multilib')
    
      10optdepends=('tcsh: for C shell sample'
    
      11	    'sh: for sh shell sample')
    
      12provides=("rexx")
    
      13conflicts=("oorexx-beta")
    
      14source=(https://downloads.sourceforge.net/project/oorexx/oorexx/${pkgver}/ooRexx-${pkgver}-${pkgrel}.debian11.x86_64.deb)
    
      15sha256sums=('72ce9135b5e05d1a9eff5cec0d9d23804cf8e4a76e2778f85bf4dba1e57ad8d6')
    
      16package() {
    
      17	echo "  -> Extracting the data.tar.xz..."
    
      18	bsdtar -xf data.tar.gz -C "$pkgdir/"
    
      19	echo "  -> Moving from /usr/local to /usr..."
    
      20	mv -v "$pkgdir/usr/local/bin"     "$pkgdir/usr/"
    
      21	mv -v "$pkgdir/usr/local/include" "$pkgdir/usr/"
    
      22	mv -v "$pkgdir/usr/local/lib"     "$pkgdir/usr/"
    
      23	mv -v "$pkgdir/usr/local/share"   "$pkgdir/usr/"
    
      24	rm -r "$pkgdir/usr/local"
    
      25}
    
      26

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 14:00:44	Medium	2
2026-06-18 16:11:54	Clean	0