open-usp-tukubai
The source is a tarball from a project-associated domain (unitama.usp-lab.com) used to build and install the software; while not on a standard forge, it is plausibly the official source, and the package only installs compiled shell commands and documentation.
Triggered rules
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from a project-associated domain (unitama.usp-lab.com) used to build and install the software; while not on a standard forge, it is plausibly the official source, and the package only installs compiled shell commands and documentation.
1 higher static finding superseded - not the current verdict (shown for transparency)
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:18
"https://unitama.usp-lab.com/download/${pkgname}-${pkgver}.tar.bz2"
PKGBUILD
1 offending line(s) highlighted# Maintainer: Masaki Waga <masakiwaga@gmail.com>
# Contributor: Tpaefawzen <960klo@gmail.com>
# Contributor: Tatsunori Aoki <ginjiro.135@gmail.com>
DLAGENTS='https::/usr/bin/curl --insecure -fLC - --retry 3 --retry-delay 3 -o %o %u'
pkgname=open-usp-tukubai
pkgver=20231122
pkgrel=2
pkgdesc="An open source version of shell commands usp Tukubai."
arch=('any')
url="https://www.uni-tama.com/html/"
license=('MIT' 'custom')
depends=('python')
conflicts=('open-usp-tukubai-git')
source=(
"https://unitama.usp-lab.com/download/${pkgname}-${pkgver}.tar.bz2"
)
md5sums=('2e64cd6e2b227e78634dad6b49280055'
)
build() {
cd "$srcdir"
sed -i 's/uconv/tukubai-&/g' Makefile
sed -i 's/tcat/tukubai-tcat/g' Makefile
sed -i 's:^HTMDIR=.*$:HTMDIR= ${PREFIX}/share/doc/${NAME}/html:' Makefile
sed -i 's:^PDFDIR=.*$:PDFDIR= ${PREFIX}/share/doc/${NAME}/pdf:' Makefile
sed -i 's:^DOCDIR=.*$:DOCDIR= ${PREFIX}/share/doc/${NAME}:' Makefile
mv COMMANDS/tcat COMMANDS/tukubai-tcat
mv COMMANDS/uconv COMMANDS/tukubai-uconv
mv COMMANDS/count COMMANDS/tukubai-count
mv man/uconv.1 man/tukubai-uconv.1
mv MANUAL/uconv.txt MANUAL/tukubai-uconv.txt
}
check () {
cd "$srcdir"
commands="1bai block_getlast calclock calsed cap cgi-name check_attr_name check_cmp_name check_date_name check_dble_name check_inlist_name check_need_name cjoin0 cjoin1 cjoin1x cjoin2 cjoin2x comma tukubai-count ctail dayslash delf delr divsen exist extname filehame formhame fromcsv fsed getfirst getlast gyo haba han isdate itouch join0 join1 join1x join2 join2x joinx juni kasan keta keycut loopj loopx maezero map marume mdate mime-read mojihame msort nameread numchar plus rank ratio retu rjson self selr sm2 sm4 sm5 tarr tateyoko tukubai-tcat tocsv tukubai-uconv ulock unmap up3 uriencode wjson xmldir yarr ycat yobi ysum zen"
for cmd in $commands; do
if ! [ -f "./COMMANDS/$cmd" ]; then
echo "Test failed: $cmd"
return 1
fi
done
}
package() {
cd "$srcdir"
make PREFIX="${pkgdir}/usr" LOCALBASE="$pkgdir/usr" install
mkdir -p "${pkgdir}/usr/share/licenses/${pkgname}/"
install -D -m644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
mkdir -p "${pkgdir}/usr/share/man/man1"
install -D -m644 man/*.1 "${pkgdir}/usr/share/man/man1"
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |