physicseditor

LOW

maintainer asm0dey 2 votes scanned 2026-10-08 00:28:03.132797

View on AUR

Why flagged

The package downloads a .deb from the official project domain (codeandweb.com) for extraction and repackaging; this is a normal AUR build pattern for binary-only software, and the host, while not a common forge, is plausibly the project's own.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a .deb from the official project domain (codeandweb.com) for extraction and repackaging; this is a normal AUR build pattern for binary-only software, and the host, while not a common forge, is plausibly the project's own.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("$pkgname-$pkgver.deb::https://www.codeandweb.com/download/$pkgname/$pkgver/PhysicsEditor-$pkgver.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Patrick Northon <northon_patrick3@yahoo.ca>
    
      2# Contributor: Wilson E. Alvarez <wilson.e.alvarez1@gmail.com>
    
      3# Contributor: Etzos <supercodingmonkey @ gmail.com>
    
      4# Contributor: Gordin <9ordin @t gmail dot com>
    
      5# Contributor: Geequlim <geequlim@gmail.com>
    
      6# Contributor: Antti Juhani Oja <antti.oja@gmail.com>
    
      7# Contributor: Pasha Finkelshteyn <me@asm0dey.site>
    
      8
    
      9pkgname=physicseditor
    
      10pkgver=2.0.5
    
      11pkgrel=1
    
      12pkgdesc="Physics editor for certain game engines such as Cocos2D-X, Corona SDK, etc."
    
      13arch=('x86_64')
    
      14url="http://www.codeandweb.com/$pkgname"
    
      15license=("custom:$pkgname")
    
      16install="$pkgname.install"
    
      17depends=('shared-mime-info' 'hicolor-icon-theme' 'desktop-file-utils' 'grantlee'
    
      18    'gcc-libs-multilib' 'qt5-svg' 'qt5-declarative' 'qt5-imageformats'
    
      19    'qt5-quickcontrols')
    
      20source=("$pkgname-$pkgver.deb::https://www.codeandweb.com/download/$pkgname/$pkgver/PhysicsEditor-$pkgver.deb")
    
      21sha256sums=('da3d712e628bf8b26c56e40b9877d1efcf6b67174371f91c9589ee07904a6039')
    
      22
    
      23build() {
    
      24    ar -x "$pkgname-$pkgver.deb"
    
      25}
    
      26
    
      27package() {
    
      28    cd ${srcdir}/
    
      29
    
      30    # Extract to the $pkgdir.
    
      31    tar xJf data.tar.xz -C "${pkgdir}/"
    
      32
    
      33    # Enter $pkgdir.
    
      34    cd ${pkgdir}/usr/lib/$pkgname/
    
      35
    
      36    # IMPORTANT NOTE: It looks like codeandweb stopped compiling with the -fPIC
    
      37    # flag. We must keep the bloat for now.
    
      38
    
      39    # Delete all the extra lib folders.
    
      40    #rm -rf generic/ grantlee/ iconengines/ imageformats/ platforminputcontexts/ platforms/ \
    
      41    #       QtGraphicalEffects/ QtQml/ QtQuick/ QtQuick.2/ xcbglintegrations/
    
      42
    
      43    # Delete the useless lib files.
    
      44    #rm -rf libGrantlee* libicudata* libicui18n* libicuuc* libQt5*
    
      45
    
      46    # Get rid of the Qt configuration that messes up LD_LIBRARY_PATH.
    
      47    #rm -rf qt.conf
    
      48
    
      49    install -Dm644 "${pkgdir}/usr/share/$pkgname/documents/LicenseAgreement.txt" \
    
      50        "${pkgdir}/usr/share/licenses/${pkgname}/LicenseAgreement.txt"
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 00:13:36	Low	2
2026-10-05 00:08:03	Low	2
2026-10-04 00:18:08	Low	2
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2
2026-09-27 00:07:07	Low	2
2026-09-26 00:12:15	Low	2
2026-09-25 00:03:36	Low	2
2026-09-24 00:24:14	Low	2
2026-09-23 00:28:13	Low	2
2026-09-22 00:15:14	Low	2
2026-09-21 00:26:32	Low	2
2026-09-20 00:25:31	Low	2
2026-09-19 00:25:36	Low	2