panoply-nodesktop

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is NASA's official domain (www.giss.nasa.gov), which is a legitimate and trusted upstream host for Panoply. The cheaper model's concern about 'untrusted host' is a false positive. However, there are real issues: (1) pkgver uses command substitution with curl at parse time, making this non-reproducible and fragile — this is a packaging quality issue, not a security threat. (2) The sha1sums array has a syntax error: '$_sha1}' has a mismatched brace (missing opening '{'), so the checksum will be an empty or malformed string, meaning integrity verification of the ZIP effectively fails. (3) Fetching the checksum dynamically from the same server as the artifact provides no real integrity guarantee (a compromised server could serve matching checksums). These are sloppy/broken packaging practices rather than a supply-chain attack: the source is official NASA infrastructure, the package installs only JARs and a shell script, and there is no executed binary from an unofficial host. The broken checksum syntax and dynamic version/checksum fetching make this 'broken' and 'low' quality, but not a genuine medium supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The source is NASA's official domain (www.giss.nasa.gov), which is a legitimate and trusted upstream host for Panoply. The cheaper model's concern about 'untrusted host' is a false positive. However, there are real issues: (1) pkgver uses command substitution with curl at parse time, making this non-reproducible and fragile — this is a packaging quality issue, not a security threat. (2) The sha1sums array has a syntax error: '$_sha1}' has a mismatched brace (missing opening '{'), so the checksum will be an empty or malformed string, meaning integrity verification of the ZIP effectively fails. (3) Fetching the checksum dynamically from the same server as the artifact provides no real integrity guarantee (a compromised server could serve matching checksums). These are sloppy/broken packaging practices rather than a supply-chain attack: the source is official NASA infrastructure, the package installs only JARs and a shell script, and there is no executed binary from an unofficial host. The broken checksum syntax and dynamic version/checksum fetching make this 'broken' and 'low' quality, but not a genuine medium supply-chain risk.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:3 pkgver="$(curl https://www.giss.nasa.gov/tools/panoply/download/ 2>/dev/null | sed -n 's/The current version of Panoply is $[[:digit:]]\+\.[[:digit:]]\+\.[[:digit:]]\+$.*/\1/p')"
PKGBUILD:24 _sha1="$(curl https://www.giss.nasa.gov/tools/panoply/download/Panoply-${pkgver}.sha1.txt 2>/dev/null | grep 'PanoplyJ.*.zip' | grep -o '^[^ ]*')"

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("http://www.giss.nasa.gov/tools/panoply/download/PanoplyJ-${pkgver}.zip"

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: MadPhysicist <jfoxrabinovitz at gmail dot com>
    
      2pkgname=panoply-nodesktop
    
      3pkgver="$(curl https://www.giss.nasa.gov/tools/panoply/download/ 2>/dev/null | sed -n 's/The current version of Panoply is \([[:digit:]]\+\.[[:digit:]]\+\.[[:digit:]]\+\).*/\1/p')"
    
      4pkgrel=1
    
      5pkgdesc='NetCDF, HDF and GRIB Data Viewer by NASA GISS (no freedesktop.org support)'
    
      6arch=('any')
    
      7url='http://www.giss.nasa.gov/tools/panoply/'
    
      8license=('custom')
    
      9groups=('nasa-tools')
    
      10depends=('java-runtime>=8')
    
      11makedepends=()
    
      12optdepends=()
    
      13provides=()
    
      14conflicts=(panoply)
    
      15replaces=()
    
      16backup=()
    
      17options=()
    
      18install=
    
      19changelog=
    
      20source=("http://www.giss.nasa.gov/tools/panoply/download/PanoplyJ-${pkgver}.zip"
    
      21        'LICENSES'
    
      22        'panoply-script.patch')
    
      23noextract=()
    
      24_sha1="$(curl https://www.giss.nasa.gov/tools/panoply/download/Panoply-${pkgver}.sha1.txt 2>/dev/null | grep 'PanoplyJ.*.zip' | grep -o '^[^ ]*')"
    
      25sha1sums=("$_sha1}"
    
      26          'a83855747414873269e21aaff1a53d13ab5de304'
    
      27          '707208d062922b5426303238870e0dd269257697')
    
      28
    
      29prepare() {
    
      30    cd ${srcdir}/PanoplyJ
    
      31    patch -uN -i ../panoply-script.patch || return 1
    
      32}
    
      33
    
      34package() {
    
      35    install -Dm644 ${srcdir}/LICENSES ${pkgdir}/usr/share/licenses/${pkgname}/LICENSES
    
      36    install -d -m755 ${pkgdir}/usr/share/java/panoply
    
      37    install -Dm644 ${srcdir}/PanoplyJ/jars/*.jar ${pkgdir}/usr/share/java/panoply
    
      38    install -Dm755 ${srcdir}/PanoplyJ/panoply.sh ${pkgdir}/usr/bin/panoply
    
      39}
    
      40
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3