pdfstudioviewer
maintainer bbx0
· 9 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads a prebuilt .deb from the official vendor's download domain, which is a standard practice for distributing proprietary software; the source is not executed but unpacked and repackaged, and the final install is a legitimate application binary with no evidence of malicious intent or supply-chain risk.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from the official vendor's download domain, which is a standard practice for distributing proprietary software; the source is not executed but unpacked and repackaged, and the final install is a legitimate application binary with no evidence of malicious intent or supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:18
source=("${_deb}::https://download.qoppa.com/${pkgname}/PDFStudioViewer_linux64.deb")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Philipp Micheel <bbx0+aur at bitdevs dot de>
2
# Contributor: Mark Wagie <mark dot wagie at proton dot me>
3
# Contributor: Qoppa Software, LLC <info at qoppa dot com>
4
5
# shellcheck shell=bash disable=SC2034,SC2154,SC2164
6
7
pkgname=pdfstudioviewer
8
_pkgname=pdfstudioviewer2024
9
pkgver=2024.0.1
10
pkgrel=2
11
pkgdesc='Review, annotate, and edit PDF Documents'
12
arch=('x86_64' 'aarch64')
13
url='https://www.qoppa.com/pdfstudioviewer'
14
license=('LicenseRef-Qoppa')
15
makedepends=('dpkg' 'desktop-file-utils' 'gendesk' 'libarchive')
16
_deb="${pkgname}-${pkgver}_linux64.deb"
17
noextract=("${_deb}")
18
source=("${_deb}::https://download.qoppa.com/${pkgname}/PDFStudioViewer_linux64.deb")
19
b2sums=('165ee30182fc17799604c942f1a5cfc02d9ab22dc5ad118a5f1f1394bb824000084847d720976e7caf3cac363c05c9ddbbfd2be2b1d00bb74d36307699037be5')
20
21
# Pin the Java version to 25 (OpenJDK). (Java versions >= 26 are not compatible.)
22
_jre_version=25
23
24
# Desktop File parameters; validate via `gendesk -n PKGBUILD`
25
_name='PDF Studio Viewer 2024'
26
_genericname='PDF Viewer'
27
_mimetypes='application/pdf'
28
_categories='Application;Office'
29
_custom='StartupWMClass=install4j-com-qoppa-pdfStudioViewer-pub-PDFStudioViewer'
30
_exec="${pkgname} %U"
31
32
pkgver() {
33
# shellcheck disable=SC2016
34
dpkg-deb --show --showformat='${Version}' "${_deb}" | tr - .
35
}
36
37
prepare() {
38
# Extract Debian Archive
39
dpkg-deb --raw-extract "${_deb}" "${pkgname}-${pkgver}"
40
cd "${pkgname}-${pkgver}"
41
42
# Extract License
43
bsdtar xf "opt/${_pkgname}/lib/pdfstudio.jar" resources/license.html
44
45
# Arch Linux customization
46
# shellcheck disable=SC1003,SC2016
47
{
48
# Use the newest verified compatible JRE and disable caching of tested JRE versions.
49
sed -i \
50
-e '/# INSTALL4J_JAVA_HOME_OVERRIDE=/a\' \
51
-e ': "${INSTALL4J_JAVA_HOME_OVERRIDE:=/usr/lib/jvm/java-'${_jre_version}'-openjdk}"\' \
52
-e ': "${INSTALL4J_NO_DB:=true}"' \
53
"opt/${_pkgname}/${_pkgname}"
54
55
# Permit the verified Java release while rejecting newer versions.
56
sed -i 's/"$ver_major" -gt "[0-9]*"/"$ver_major" -gt "'${_jre_version}'"/' "opt/${_pkgname}/${_pkgname}"
57
58
# Remove obsolete Java export that causes a startup warning on Java >=24.
59
sed -i 's| --add-exports java.base/sun.security.action=ALL-UNNAMED||g' "opt/${_pkgname}/${_pkgname}"
60
61
# Remove bundled JRE
62
rm -rf "opt/${_pkgname}/jre"
63
64
# Remove standalone updater
65
rm "opt/${_pkgname}/updater"
66
rm "opt/${_pkgname}/pdfstudiosu"
67
}
68
69
# Generate the ${pkgname}.desktop file
70
gendesk -n \
71
--pkgname "${pkgname}" \
72
--pkgdesc "${pkgdesc}" \
73
--name "${_name}" \
74
--genericname "${_genericname}" \
75
--mimetypes "${_mimetypes}" \
76
--categories "${_categories}" \
77
--custom "${_custom}" \
78
--exec "${_exec}"
79
}
80
81
package() {
82
cd "${pkgname}-${pkgver}"
83
84
# Runtime dependencies
85
depends=("java-runtime-openjdk=${_jre_version}" 'sane')
86
87
# Application /opt/${pkgname}
88
install -d "${pkgdir}/opt/${pkgname}"
89
cp -a "opt/${_pkgname}/." "${pkgdir}/opt/${pkgname}/"
90
91
# Link /usr/bin/${pkgname}
92
install -d "${pkgdir}/usr/bin"
93
ln -s "/opt/${pkgname}/${_pkgname}" "${pkgdir}/usr/bin/${pkgname}"
94
95
# Desktop Entry and Icon
96
desktop-file-install -m 644 --dir "${pkgdir}/usr/share/applications/" "${pkgname}.desktop"
97
install -Dm644 "opt/${_pkgname}/.install4j/${_pkgname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
98
99
# License
100
install -Dm644 resources/license.html -t "${pkgdir}/usr/share/licenses/${pkgname}"
101
}
102
Changes since previous scan
--- PKGBUILD @ 2026-06-19 19:07+++ PKGBUILD @ 2026-08-03 00:08@@ -7,16 +7,19 @@ pkgname=pdfstudioviewer _pkgname=pdfstudioviewer2024 pkgver=2024.0.1-pkgrel=1+pkgrel=2 pkgdesc='Review, annotate, and edit PDF Documents' arch=('x86_64' 'aarch64') url='https://www.qoppa.com/pdfstudioviewer'-license=('custom')+license=('LicenseRef-Qoppa') makedepends=('dpkg' 'desktop-file-utils' 'gendesk' 'libarchive') _deb="${pkgname}-${pkgver}_linux64.deb" noextract=("${_deb}") source=("${_deb}::https://download.qoppa.com/${pkgname}/PDFStudioViewer_linux64.deb") b2sums=('165ee30182fc17799604c942f1a5cfc02d9ab22dc5ad118a5f1f1394bb824000084847d720976e7caf3cac363c05c9ddbbfd2be2b1d00bb74d36307699037be5')++# Pin the Java version to 25 (OpenJDK). (Java versions >= 26 are not compatible.)+_jre_version=25 # Desktop File parameters; validate via `gendesk -n PKGBUILD` _name='PDF Studio Viewer 2024'@@ -42,15 +45,18 @@ # Arch Linux customization # shellcheck disable=SC1003,SC2016 {- # Probe the default JRE first and disable caching of tested JRE versions.+ # Use the newest verified compatible JRE and disable caching of tested JRE versions. sed -i \ -e '/# INSTALL4J_JAVA_HOME_OVERRIDE=/a\' \- -e ': "${INSTALL4J_JAVA_HOME_OVERRIDE:=/usr/lib/jvm/default-runtime}"\' \+ -e ': "${INSTALL4J_JAVA_HOME_OVERRIDE:=/usr/lib/jvm/java-'${_jre_version}'-openjdk}"\' \ -e ': "${INSTALL4J_NO_DB:=true}"' \ "opt/${_pkgname}/${_pkgname}" - # Disable the maximum java version check.- sed -i 's/"$ver_major" -gt "[0-9]*"/"$ver_major" -gt "99"/' "opt/${_pkgname}/${_pkgname}"+ # Permit the verified Java release while rejecting newer versions.+ sed -i 's/"$ver_major" -gt "[0-9]*"/"$ver_major" -gt "'${_jre_version}'"/' "opt/${_pkgname}/${_pkgname}"++ # Remove obsolete Java export that causes a startup warning on Java >=24.+ sed -i 's| --add-exports java.base/sun.security.action=ALL-UNNAMED||g' "opt/${_pkgname}/${_pkgname}" # Remove bundled JRE rm -rf "opt/${_pkgname}/jre"@@ -76,7 +82,7 @@ cd "${pkgname}-${pkgver}" # Runtime dependencies- depends=('java-runtime>=9' 'sane')+ depends=("java-runtime-openjdk=${_jre_version}" 'sane') # Application /opt/${pkgname} install -d "${pkgdir}/opt/${pkgname}"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 19:39:35 | MEDIUM | 1 |
| 2026-06-19 19:07:35 | CLEAN | 2 |
| 2026-06-18 16:11:54 | MEDIUM | 1 |