paintstorm

maintainer xiota · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a self-extracting installer and a library source tarball from the project's official and SourceForge URLs; building from official project sources, even on non-whitelisted hosts, is standard for AUR and not inherently dangerous.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a self-extracting installer and a library source tarball from the project's official and SourceForge URLs; building from official project sources, even on non-whitelisted hosts, is standard for AUR and not inherently dangerous.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:33 "$_filename.$_pkgext"::"https://www.paintstormstudio.com/$_filename.$_pkgext"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:
    
      2# Contributor: mditto <michael.r.ditto@gmail.com>
    
      3
    
      4_pkgname="paintstorm"
    
      5pkgname="$_pkgname"
    
      6pkgver=2.50
    
      7pkgrel=2
    
      8pkgdesc="Professional software for digital painting"
    
      9url="https://www.paintstormstudio.com"
    
      10license=('LicenseRef-Paintstorm')
    
      11arch=('x86_64')
    
      12
    
      13depends=(
    
      14  'ftgl'
    
      15  'gtk2'
    
      16  'libcurl-gnutls'
    
      17  'libgl'
    
      18)
    
      19makedepends=(
    
      20  'html-xml-utils'
    
      21  'patchelf'
    
      22  'w3m'
    
      23)
    
      24
    
      25options=('!strip' '!debug' 'emptydirs')
    
      26
    
      27_glew_pkgver=1.13.0
    
      28_glew_pkgsrc="glew-$_glew_pkgver"
    
      29
    
      30_filename="Paintstorm_linux_v${pkgver}.run"
    
      31_pkgext="tar.gz"
    
      32source=(
    
      33  "$_filename.$_pkgext"::"https://www.paintstormstudio.com/$_filename.$_pkgext"
    
      34  "$_glew_pkgsrc.$_pkgext"::"https://downloads.sourceforge.net/glew/$_glew_pkgsrc.tgz"
    
      35)
    
      36sha256sums=(
    
      37  'aaa581752027b3445578dfc9dc3e72048194f4908291eaf11c60b91947ac35c1'
    
      38  'aa25dc48ed84b0b64b8d41cdd42c8f40f149c37fa2ffa39cd97f42c78d128bc7'
    
      39)
    
      40
    
      41_privacy_policy="privacy_policy"
    
      42_privacy_policy_url="https://www.paintstormstudio.com/help/privacy-policy/"
    
      43_terms_of_use="terms_of_use"
    
      44_terms_of_use_url="https://www.paintstormstudio.com/help/license-agreement/"
    
      45
    
      46prepare() {
    
      47  # glew
    
      48  sed -i 's|lib64|lib|' "$_glew_pkgsrc"/config/Makefile.linux
    
      49
    
      50  # extract files
    
      51  sh "$_filename" --noexec
    
      52
    
      53  # delete junk .* files
    
      54  find "$srcdir/PaintstormInstall/paintstorm" -type f -name '.*' -delete
    
      55  find "$srcdir/PaintstormInstall/paintstorm" -type f -iname '~*' -delete
    
      56
    
      57  # privacy policy
    
      58  curl --no-progress-meter \
    
      59    -o "$_privacy_policy-1.html" \
    
      60    "$_privacy_policy_url"
    
      61
    
      62  hxnormalize -x "$_privacy_policy-1.html" \
    
      63    | hxselect article \
    
      64      1> "$_privacy_policy-2.html" \
    
      65      2> /dev/null
    
      66
    
      67  w3m -O UTF-8 -cols 80 -dump "$_privacy_policy-2.html" > "$_privacy_policy.txt"
    
      68
    
      69  # terms of use
    
      70  curl --no-progress-meter \
    
      71    -o "$_terms_of_use-1.html" \
    
      72    "$_terms_of_use_url"
    
      73
    
      74  hxnormalize -x "$_terms_of_use-1.html" \
    
      75    | hxselect article \
    
      76      1> "$_terms_of_use-2.html" \
    
      77      2> /dev/null
    
      78
    
      79  w3m -O UTF-8 -cols 80 -dump "$_terms_of_use-2.html" > "$_terms_of_use.txt"
    
      80}
    
      81
    
      82build() {
    
      83  cd "$_glew_pkgsrc"
    
      84  make
    
      85}
    
      86
    
      87package() {
    
      88  # files
    
      89  install -dm755 "$pkgdir/usr"/{bin,share}
    
      90  mv PaintstormInstall/paintstorm "$pkgdir/usr/share/"
    
      91
    
      92  # launcher
    
      93  install -Dm755 "PaintstormInstall/paintstorm.desktop" -t "$pkgdir/usr/share/applications/"
    
      94
    
      95  # rpath
    
      96  patchelf --set-rpath '$ORIGIN' "$pkgdir/usr/share/paintstorm/Paintstorm"
    
      97
    
      98  # symlink
    
      99  ln -srf "$pkgdir/usr/share/paintstorm/Paintstorm" "$pkgdir/usr/bin/paintstorm"
    
      100
    
      101  # glew
    
      102  install -Dm644 "$_glew_pkgsrc"/lib/libGLEW.so* -t "$pkgdir/usr/share/paintstorm/"
    
      103
    
      104  # prevent crash
    
      105  install -Dm644 /dev/null "$pkgdir/usr/share/fonts/opentype/.paintstorm"
    
      106  install -Dm644 /dev/null "$pkgdir/usr/share/fonts/truetype/.paintstorm"
    
      107
    
      108  # license/eula
    
      109  install -Dm644 "$_privacy_policy.txt" -t "$pkgdir/usr/share/licenses/$pkgname"
    
      110  install -Dm644 "$_terms_of_use.txt" -t "$pkgdir/usr/share/licenses/$pkgname"
    
      111}
    
      112

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2