pdfstudioviewer
LOW
maintainer bbx0
9 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt .deb from the official vendor's download domain, which is a standard practice for distributing proprietary software; the source is not executed but unpacked and repackaged, and the final install is a legitimate application binary with no evidence of malicious intent or supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from the official vendor's download domain, which is a standard practice for distributing proprietary software; the source is not executed but unpacked and repackaged, and the final install is a legitimate application binary with no evidence of malicious intent or supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:18
source=("${_deb}::https://download.qoppa.com/${pkgname}/PDFStudioViewer_linux64.deb")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Philipp Micheel <bbx0+aur at bitdevs dot de>
2
# Contributor: Mark Wagie <mark dot wagie at proton dot me>
3
# Contributor: Qoppa Software, LLC <info at qoppa dot com>
4
5
# shellcheck shell=bash disable=SC2034,SC2154,SC2164
6
7
pkgname=pdfstudioviewer
8
_pkgname=pdfstudioviewer2024
9
pkgver=2024.0.1
10
pkgrel=2
11
pkgdesc='Review, annotate, and edit PDF Documents'
12
arch=('x86_64' 'aarch64')
13
url='https://www.qoppa.com/pdfstudioviewer'
14
license=('LicenseRef-Qoppa')
15
makedepends=('dpkg' 'desktop-file-utils' 'gendesk' 'libarchive')
16
_deb="${pkgname}-${pkgver}_linux64.deb"
17
noextract=("${_deb}")
18
source=("${_deb}::https://download.qoppa.com/${pkgname}/PDFStudioViewer_linux64.deb")
19
b2sums=('165ee30182fc17799604c942f1a5cfc02d9ab22dc5ad118a5f1f1394bb824000084847d720976e7caf3cac363c05c9ddbbfd2be2b1d00bb74d36307699037be5')
20
21
# Pin the Java version to 25 (OpenJDK). (Java versions >= 26 are not compatible.)
22
_jre_version=25
23
24
# Desktop File parameters; validate via `gendesk -n PKGBUILD`
25
_name='PDF Studio Viewer 2024'
26
_genericname='PDF Viewer'
27
_mimetypes='application/pdf'
28
_categories='Application;Office'
29
_custom='StartupWMClass=install4j-com-qoppa-pdfStudioViewer-pub-PDFStudioViewer'
30
_exec="${pkgname} %U"
31
32
pkgver() {
33
# shellcheck disable=SC2016
34
dpkg-deb --show --showformat='${Version}' "${_deb}" | tr - .
35
}
36
37
prepare() {
38
# Extract Debian Archive
39
dpkg-deb --raw-extract "${_deb}" "${pkgname}-${pkgver}"
40
cd "${pkgname}-${pkgver}"
41
42
# Extract License
43
bsdtar xf "opt/${_pkgname}/lib/pdfstudio.jar" resources/license.html
44
45
# Arch Linux customization
46
# shellcheck disable=SC1003,SC2016
47
{
48
# Use the newest verified compatible JRE and disable caching of tested JRE versions.
49
sed -i \
50
-e '/# INSTALL4J_JAVA_HOME_OVERRIDE=/a\' \
51
-e ': "${INSTALL4J_JAVA_HOME_OVERRIDE:=/usr/lib/jvm/java-'${_jre_version}'-openjdk}"\' \
52
-e ': "${INSTALL4J_NO_DB:=true}"' \
53
"opt/${_pkgname}/${_pkgname}"
54
55
# Permit the verified Java release while rejecting newer versions.
56
sed -i 's/"$ver_major" -gt "[0-9]*"/"$ver_major" -gt "'${_jre_version}'"/' "opt/${_pkgname}/${_pkgname}"
57
58
# Remove obsolete Java export that causes a startup warning on Java >=24.
59
sed -i 's| --add-exports java.base/sun.security.action=ALL-UNNAMED||g' "opt/${_pkgname}/${_pkgname}"
60
61
# Remove bundled JRE
62
rm -rf "opt/${_pkgname}/jre"
63
64
# Remove standalone updater
65
rm "opt/${_pkgname}/updater"
66
rm "opt/${_pkgname}/pdfstudiosu"
67
}
68
69
# Generate the ${pkgname}.desktop file
70
gendesk -n \
71
--pkgname "${pkgname}" \
72
--pkgdesc "${pkgdesc}" \
73
--name "${_name}" \
74
--genericname "${_genericname}" \
75
--mimetypes "${_mimetypes}" \
76
--categories "${_categories}" \
77
--custom "${_custom}" \
78
--exec "${_exec}"
79
}
80
81
package() {
82
cd "${pkgname}-${pkgver}"
83
84
# Runtime dependencies
85
depends=("java-runtime-openjdk=${_jre_version}" 'sane')
86
87
# Application /opt/${pkgname}
88
install -d "${pkgdir}/opt/${pkgname}"
89
cp -a "opt/${_pkgname}/." "${pkgdir}/opt/${pkgname}/"
90
91
# Link /usr/bin/${pkgname}
92
install -d "${pkgdir}/usr/bin"
93
ln -s "/opt/${pkgname}/${_pkgname}" "${pkgdir}/usr/bin/${pkgname}"
94
95
# Desktop Entry and Icon
96
desktop-file-install -m 644 --dir "${pkgdir}/usr/share/applications/" "${pkgname}.desktop"
97
install -Dm644 "opt/${_pkgname}/.install4j/${_pkgname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
98
99
# License
100
install -Dm644 resources/license.html -t "${pkgdir}/usr/share/licenses/${pkgname}"
101
}
102
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |