openide-bin

MEDIUM

maintainer dimio 7 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt binary tarball from a non-standard, non-whitelisted host (download.openide.ru) which is not a common forge or official vendor domain, posing a supply-chain risk if the host is compromised or the download is tampered with.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source_x86_64=("https://download.openide.ru/${pkgver}/openIDE-${pkgver}.tar.gz")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt binary tarball from a non-standard, non-whitelisted host (download.openide.ru) which is not a common forge or official vendor domain, posing a supply-chain risk if the host is compromised or the download is tampered with.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Dimio <dimio at dimio dot org>
    
      2
    
      3_appname=openide
    
      4pkgname="$_appname-bin"
    
      5pkgver=262.10968.63.1
    
      6pkgrel=1
    
      7pkgdesc="OpenIDE is an open source software development tool for Java, Python, and other programming languages. It was created by the Astra Group, Haulmont, and Axiom JDK companies. It is fork of IntelliJ IDEA CE."
    
      8arch=(x86_64)
    
      9url="https://openide.ru"
    
      10license=('AGPL-3.0-or-later')
    
      11conflicts=(
    
      12  "openide"
    
      13)
    
      14source=(
    
      15  openide.desktop
    
      16  openide.sh
    
      17)
    
      18
    
      19install=openide.install
    
      20
    
      21source_x86_64=("https://download.openide.ru/${pkgver}/openIDE-${pkgver}.tar.gz")
    
      22
    
      23options=(!strip)
    
      24sha256sums=('aa3e4f48f311c7b9368c878c05ff6b93672ab6da56bd60aba1109c118e7cbed5'
    
      25            '5df2ba94996f8e7bdcde97c9b60aef128c65f5308775b02ea7df41395523c88f')
    
      26sha256sums_x86_64=('ed21f912a504de3eadd880bc10283346bce3f8095aec39451ff0c0bd2df2677e')
    
      27
    
      28package() {
    
      29  cd ""openIDE-${pkgver}""
    
      30
    
      31  # workaround FS#40934
    
      32  # see https://bugs.archlinux.org/task/40934
    
      33  sed -i 's/lcd/on/' bin/*.vmoptions
    
      34
    
      35  rm -rf bin/fsnotifier-arm
    
      36
    
      37  install -dm 755 "${pkgdir}"/usr/share/{licenses,pixmaps,openide}
    
      38  cp -dr --no-preserve='ownership' bin jbr lib modules plugins \
    
      39    product-info.json "${pkgdir}"/usr/share/openide/
    
      40  cp -dr --no-preserve='ownership' license "${pkgdir}"/usr/share/licenses/openide/
    
      41  cp -dr --no-preserve='ownership' bin/openide.png "${pkgdir}"/usr/share/pixmaps/
    
      42  install -Dm 644 ../openide.desktop -t "${pkgdir}"/usr/share/applications/
    
      43  install -Dm 755 ../openide.sh "${pkgdir}"/usr/bin/openide
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2