open-usp-tukubai

maintainer MasWag · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a tarball from a project-associated domain (unitama.usp-lab.com) used to build and install the software; while not on a standard forge, it is plausibly the official source, and the package only installs compiled shell commands and documentation.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from a project-associated domain (unitama.usp-lab.com) used to build and install the software; while not on a standard forge, it is plausibly the official source, and the package only installs compiled shell commands and documentation.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 "https://unitama.usp-lab.com/download/${pkgname}-${pkgver}.tar.bz2"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Masaki Waga <masakiwaga@gmail.com>
    
      2# Contributor: Tpaefawzen <960klo@gmail.com>
    
      3# Contributor: Tatsunori Aoki <ginjiro.135@gmail.com>
    
      4
    
      5DLAGENTS='https::/usr/bin/curl --insecure -fLC - --retry 3 --retry-delay 3 -o %o %u'
    
      6
    
      7pkgname=open-usp-tukubai
    
      8pkgver=20231122
    
      9pkgrel=2
    
      10pkgdesc="An open source version of shell commands usp Tukubai."
    
      11arch=('any')
    
      12url="https://www.uni-tama.com/html/"
    
      13license=('MIT' 'custom')
    
      14depends=('python')
    
      15conflicts=('open-usp-tukubai-git')
    
      16
    
      17source=(
    
      18"https://unitama.usp-lab.com/download/${pkgname}-${pkgver}.tar.bz2"
    
      19)
    
      20
    
      21md5sums=('2e64cd6e2b227e78634dad6b49280055'
    
      22)
    
      23
    
      24build() {
    
      25  cd "$srcdir"
    
      26  sed -i 's/uconv/tukubai-&/g' Makefile
    
      27  sed -i 's/tcat/tukubai-tcat/g' Makefile
    
      28  sed -i 's:^HTMDIR=.*$:HTMDIR=		${PREFIX}/share/doc/${NAME}/html:' Makefile
    
      29  sed -i 's:^PDFDIR=.*$:PDFDIR=		${PREFIX}/share/doc/${NAME}/pdf:' Makefile
    
      30  sed -i 's:^DOCDIR=.*$:DOCDIR=		${PREFIX}/share/doc/${NAME}:' Makefile
    
      31
    
      32  mv COMMANDS/tcat COMMANDS/tukubai-tcat
    
      33  mv COMMANDS/uconv COMMANDS/tukubai-uconv
    
      34  mv COMMANDS/count COMMANDS/tukubai-count
    
      35  mv man/uconv.1 man/tukubai-uconv.1
    
      36
    
      37  mv MANUAL/uconv.txt MANUAL/tukubai-uconv.txt
    
      38}
    
      39
    
      40check () {
    
      41  cd "$srcdir"
    
      42  commands="1bai block_getlast calclock calsed cap cgi-name check_attr_name check_cmp_name check_date_name check_dble_name check_inlist_name check_need_name cjoin0 cjoin1 cjoin1x cjoin2 cjoin2x comma tukubai-count ctail dayslash delf delr divsen exist extname filehame formhame fromcsv fsed getfirst getlast gyo haba han isdate itouch join0 join1 join1x join2 join2x joinx juni kasan keta keycut loopj loopx maezero map marume mdate mime-read mojihame msort nameread numchar plus rank ratio retu rjson self selr sm2 sm4 sm5 tarr tateyoko tukubai-tcat tocsv tukubai-uconv ulock unmap up3 uriencode wjson xmldir yarr ycat yobi ysum zen"
    
      43
    
      44  for cmd in $commands; do
    
      45    if ! [ -f "./COMMANDS/$cmd" ]; then
    
      46      echo "Test failed: $cmd"
    
      47      return 1
    
      48    fi
    
      49  done
    
      50}
    
      51
    
      52package() {
    
      53  cd "$srcdir"
    
      54
    
      55  make PREFIX="${pkgdir}/usr" LOCALBASE="$pkgdir/usr" install
    
      56  mkdir -p "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      57  install -D -m644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      58  mkdir -p "${pkgdir}/usr/share/man/man1"
    
      59  install -D -m644 man/*.1 "${pkgdir}/usr/share/man/man1"
    
      60}
    
      61

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2