openflights-data-git
LOW
maintainer dreieck
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads data files and licenses from non-whitelisted but project-owned hosts (github.com, openflights.org); these are non-executable data assets, so the worst case of a swapped source is data tampering, not code execution.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package downloads data files and licenses from non-whitelisted but project-owned hosts (github.com, openflights.org); these are non-executable data assets, so the worst case of a swapped source is data tampering, not code execution.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:14
url="http://openflights.org/data" -
PKGBUILD:43
"License_ODbL_1.0.html::http://opendatacommons.org/licenses/odbl/1.0/"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: dreieck
2
3
# PKGBUILD last time manually edited: At least on 2025-09-08.
4
5
_gitname=openflights
6
_pkgname="${_gitname}-data"
7
pkgname="${_pkgname}-git"
8
epoch=0
9
_pkgver=latest
10
pkgver=r35.20200131
11
pkgrel=2
12
pkgdesc="Airport, train station, ferry terminal, airline and flight routes data as CSV files to be used e.g. in GIS-applications."
13
arch=(any)
14
url="http://openflights.org/data"
15
license=(
16
'ODbL-1.0'
17
'LicenseRef-DbCL-1.0'
18
)
19
20
groups=(
21
"openflights"
22
)
23
24
depends=()
25
makedepends=(
26
'git'
27
)
28
replaces=(
29
"${_pkgname}-latest"
30
)
31
optdepends=()
32
33
provides=(
34
"${_pkgname}=${pkgver}"
35
)
36
conflicts=(
37
"${_pkgname}"
38
)
39
40
source=(
41
"${_gitname}::git+https://github.com/jpatokal/openflights.git"
42
"info.html::http://openflights.org/data"
43
"License_ODbL_1.0.html::http://opendatacommons.org/licenses/odbl/1.0/"
44
"License_DbCL_1.0.html::http://opendatacommons.org/licenses/dbcl/1.0/"
45
)
46
47
sha256sums=(
48
'SKIP'
49
'SKIP'
50
'SKIP'
51
'SKIP'
52
)
53
54
prepare() {
55
cd "${srcdir}/${_gitname}"
56
57
git log data/*.dat > git.log
58
59
echo "${url}" > "info.url"
60
}
61
62
pkgver() {
63
cd "${srcdir}/${_gitname}"
64
65
_rev="$(git rev-list --count HEAD data/*.dat)"
66
_date="$(git log -1 --date=format:"%Y%m%d" --format="%ad" data/*.dat)"
67
68
if [ -z "${_rev}" ]; then
69
error "Could not determine git commit count of 'data/*.dat'."
70
return 1
71
else
72
printf '%s' "r${_rev}.${_date}"
73
fi
74
}
75
76
package() {
77
_instdirbase='/opt/openflights-data'
78
_instdir="${pkgdir}/${_instdirbase}"
79
_docdirbase="/usr/share/doc/${_pkgname}"
80
_docdir="${pkgdir}/${_docdirbase}"
81
_licensedirbase="/usr/share/licenses/${pkgname}"
82
_licensedir="${pkgdir}/${_licensedirbase}"
83
84
cd "${srcdir}/${_gitname}"
85
86
87
# "https://raw.githubusercontent.com/jpatokal/openflights/master/data/airports.dat"
88
# "https://raw.githubusercontent.com/jpatokal/openflights/master/data/airports-extended.dat"
89
# "https://raw.githubusercontent.com/jpatokal/openflights/master/data/airports-dafif.dat"
90
# "https://raw.githubusercontent.com/jpatokal/openflights/master/data/airlines.dat"
91
# "https://raw.githubusercontent.com/jpatokal/openflights/master/data/routes.dat"
92
# "https://raw.githubusercontent.com/jpatokal/openflights/master/data/countries.dat"
93
# "https://raw.githubusercontent.com/jpatokal/openflights/master/data/locales.dat"
94
95
install -Dvm644 -t "${_instdir}" "data"/*.dat
96
97
install -Dvm644 -t "${_docdir}" "${srcdir}/info.html"
98
install -Dvm644 -t "${_docdir}" git.log info.url
99
100
install -Dvm644 -t "${_licensedir}" "${srcdir}"/License_{ODbL,DbCL}_1.0.html
101
}
102
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |