ourico

maintainer bidulock · 12 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a tarball from a personal domain (plhk.ru), which is not on a standard whitelist, but it is the project's own source code being built; the realistic worst case of a swapped source is building malicious code, but there is no indication of obfuscation or remote code execution, and the package otherwise follows normal AUR practices.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The source is a tarball from a personal domain (plhk.ru), which is not on a standard whitelist, but it is the project's own source code being built; the realistic worst case of a swapped source is building malicious code, but there is no indication of obfuscation or remote code execution, and the package otherwise follows normal AUR practices.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=(http://plhk.ru/static/$pkgname/$pkgname-$pkgver.tar.gz)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: TDY <tdy@archlinux.info>
    
      2
    
      3pkgname=ourico
    
      4pkgver=0.1.7
    
      5pkgrel=1
    
      6pkgdesc="A lightweight EWMH taskbar, originally designed for echinus"
    
      7arch=('i686' 'x86_64')
    
      8#url="http://freecode.com/projects/ourico"
    
      9url="http://freshmeat.sourceforge.net/projects/ourico"
    
      10license=('MIT')
    
      11depends=('libxft')
    
      12conflicts=('ourico-hg')
    
      13install=ourico.install
    
      14source=(http://plhk.ru/static/$pkgname/$pkgname-$pkgver.tar.gz)
    
      15md5sums=('6b8af8bf5afc7b9b9f13500c25b19db4')
    
      16
    
      17build() {
    
      18  cd "$srcdir/$pkgname-$pkgver"
    
      19  sed -i 's/\(CFLAGS \)= -Os/\1+= -g/; s/\(LDFLAGS \)= -s/\1+= -g/' config.mk
    
      20  sed -i 's+usr/local/share/examples+etc/xdg+' $pkgname.1
    
      21  make
    
      22}
    
      23
    
      24package() {
    
      25  cd "$srcdir/$pkgname-$pkgver"
    
      26  install -Dm755 $pkgname "$pkgdir/usr/bin/$pkgname"
    
      27  install -Dm644 ouricorc "$pkgdir/etc/xdg/$pkgname/ouricorc"
    
      28  install -Dm644 $pkgname.1 "$pkgdir/usr/share/man/man1/$pkgname.1"
    
      29  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      30}
    
      31
    
      32# vim:set ts=2 sw=2 et:
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2