positron-ide-bin

maintainer Qingxu · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt .deb from Posit's official CDN (cdn.posit.co), which is plausibly the project's own release infrastructure; the downloaded binary is not executed during build, and the checksums are verified, making this a standard bin package with low risk despite the non-whitelisted host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from Posit's official CDN (cdn.posit.co), which is plausibly the project's own release infrastructure; the downloaded binary is not executed during build, and the checksums are verified, making this a standard bin package with low risk despite the non-whitelisted host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:62 "$pkgname-$pkgver-x86_64.deb::https://cdn.posit.co/positron/releases/deb/x86_64/Positron-${_upstream_pkgver}-x64.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Qingxu <me@linioi.com>
    
      2pkgname=positron-ide-bin
    
      3pkgver=2026.07.1.5
    
      4_upstream_pkgver=${pkgver%.*}-${pkgver##*.}
    
      5pkgrel=1
    
      6pkgdesc='A next-generation data science IDE from Posit'
    
      7arch=(
    
      8    'x86_64'
    
      9    'aarch64'
    
      10)
    
      11url='https://github.com/posit-dev/positron'
    
      12license=(
    
      13    'Elastic-2.0'
    
      14)
    
      15depends=(
    
      16    'alsa-lib'
    
      17    'at-spi2-core'
    
      18    'cairo'
    
      19    'dbus'
    
      20    'expat'
    
      21    'glib2'
    
      22    'gtk3'
    
      23    'libcups'
    
      24    'libsecret'
    
      25    'libx11'
    
      26    'libxcb'
    
      27    'libxcomposite'
    
      28    'libxdamage'
    
      29    'libxext'
    
      30    'libxfixes'
    
      31    'libxkbcommon'
    
      32    'libxkbfile'
    
      33    'libxrandr'
    
      34    'mesa'
    
      35    'nspr'
    
      36    'nss'
    
      37    'pango'
    
      38    'systemd-libs'
    
      39    'xdg-utils'
    
      40)
    
      41optdepends=(
    
      42    'bash-completion: command-line completion'
    
      43    'nodejs: Node.js runtime support'
    
      44    'python: Python runtime support'
    
      45    'r: R runtime support'
    
      46    'vulkan-intel: Intel Vulkan driver'
    
      47    'vulkan-radeon: Radeon Vulkan driver'
    
      48    'vulkan-icd-loader: Vulkan ICD loader'
    
      49    'webkit2gtk-4.1: Microsoft account authentication'
    
      50)
    
      51provides=(
    
      52    'positron-ide'
    
      53)
    
      54conflicts=(
    
      55    'positron-ide-devel-bin'
    
      56)
    
      57options=(
    
      58    '!strip'
    
      59    '!debug'
    
      60)
    
      61source_x86_64=(
    
      62    "$pkgname-$pkgver-x86_64.deb::https://cdn.posit.co/positron/releases/deb/x86_64/Positron-${_upstream_pkgver}-x64.deb"
    
      63)
    
      64source_aarch64=(
    
      65    "$pkgname-$pkgver-aarch64.deb::https://cdn.posit.co/positron/releases/deb/arm64/Positron-${_upstream_pkgver}-arm64.deb"
    
      66)
    
      67noextract=(
    
      68    "$pkgname-$pkgver-x86_64.deb"
    
      69    "$pkgname-$pkgver-aarch64.deb"
    
      70)
    
      71sha256sums_x86_64=('432e22d31e65250e0a1eacf0cf34d58e115fd6f9e70516b52fddabf6791b9800')
    
      72sha256sums_aarch64=('a928ea0c95ef98f6b8a8e16fb9724f024ef40546af807fcd2a851dc46bfd2b4d')
    
      73
    
      74package() {
    
      75    local _deb
    
      76
    
      77    case "$CARCH" in
    
      78    x86_64)
    
      79        _deb="$srcdir/$pkgname-$pkgver-x86_64.deb"
    
      80        ;;
    
      81    aarch64)
    
      82        _deb="$srcdir/$pkgname-$pkgver-aarch64.deb"
    
      83        ;;
    
      84    esac
    
      85
    
      86    ar p "$_deb" data.tar.xz | bsdtar -xJf - -C "$pkgdir"
    
      87
    
      88    install -dm755 \
    
      89        "$pkgdir/usr/bin" \
    
      90        "$pkgdir/usr/share/licenses/$pkgname"
    
      91
    
      92    ln -s /usr/share/positron/bin/positron "$pkgdir/usr/bin/positron"
    
      93
    
      94    sed -i \
    
      95        -e 's|^Exec=/usr/share/positron/positron %F$|Exec=/usr/bin/positron %F|' \
    
      96        -e 's|^Exec=/usr/share/positron/positron --new-window %F$|Exec=/usr/bin/positron --new-window %F|' \
    
      97        "$pkgdir/usr/share/applications/positron.desktop"
    
      98
    
      99    sed -i \
    
      100        -e 's|^Exec=/usr/share/positron/positron --open-url %U$|Exec=/usr/bin/positron --open-url %U|' \
    
      101        "$pkgdir/usr/share/applications/positron-url-handler.desktop"
    
      102
    
      103    chmod 4755 "$pkgdir/usr/share/positron/chrome-sandbox"
    
      104
    
      105    # Fix world-writable files from upstream .deb
    
      106    find "$pkgdir" -type f -perm /0002 -exec chmod o-w {} +
    
      107
    
      108    install -Dm644 \
    
      109        "$pkgdir/usr/share/positron/resources/app/LICENSE.txt" \
    
      110        "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      111    install -Dm644 \
    
      112        "$pkgdir/usr/share/positron/resources/app/NOTICE" \
    
      113        "$pkgdir/usr/share/licenses/$pkgname/NOTICE"
    
      114    install -Dm644 \
    
      115        "$pkgdir/usr/share/positron/resources/app/ThirdPartyNotices.txt" \
    
      116        "$pkgdir/usr/share/licenses/$pkgname/ThirdPartyNotices.txt"
    
      117    install -Dm644 \
    
      118        "$pkgdir/usr/share/positron/LICENSES.chromium.html" \
    
      119        "$pkgdir/usr/share/licenses/$pkgname/LICENSES.chromium.html"
    
      120}
    
      121

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2