pymol-git

maintainer brisvag · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The non-standard host is only used to download a static PNG icon, which is not executable and poses no code execution risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host is only used to download a static PNG icon, which is not executable and poses no code execution risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:34 ${_name}.png::"https://c.fsdn.com/allura/p/pymol/icon")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer : Matthijs Tadema <m dot j dot tadema at pm dot com>
    
      2# Contributor: Lorenzo Gaifas <brisvag at gmail dot com>
    
      3# Contributor: Caleb Maclennan <caleb@alerque.com>
    
      4# Contributor: Evgeniy Alekseev <arcanis at archlinux dot org>
    
      5# Contributor: graysky
    
      6# Contributor: Tomasz Żok <tomasz dot zok at gmail dot com>
    
      7
    
      8_name=pymol
    
      9pkgname="${_name}-git"
    
      10pkgver=r5647.071998658
    
      11pkgrel=1
    
      12pkgdesc='Molecular visualization system on an Open Source foundation'
    
      13arch=(x86_64)
    
      14url=https://pymol.org
    
      15license=(custom)
    
      16depends=(freetype2
    
      17         glew
    
      18         glm
    
      19         glut
    
      20         netcdf
    
      21         netcdf-cxx
    
      22         python-numpy
    
      23         tcsh)
    
      24makedepends=(desktop-file-utils
    
      25             gendesk
    
      26             mmtf-cpp
    
      27             msgpack-c
    
      28             python-{build,installer,wheel}
    
      29             python-setuptools)
    
      30optdepends=('python-pyqt5: Qt5 based UI')
    
      31conflicts=('pymol')
    
      32provides=("${_name}=${pkgver}")
    
      33source=(${_name}::"git+https://github.com/schrodinger/pymol-open-source.git"
    
      34		${_name}.png::"https://c.fsdn.com/allura/p/pymol/icon")
    
      35md5sums=('SKIP'
    
      36         'a6b62ae41658a772f75b3b123a8e5c0b')
    
      37
    
      38pkgver() {
    
      39    cd "${srcdir}/${_name}"
    
      40    printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      41}
    
      42
    
      43prepare() {
    
      44	# create desktop file
    
      45	gendesk -f -n \
    
      46			--pkgname "${_name}" \
    
      47			--name="PyMOL Molecular Graphics System" \
    
      48			--pkgdesc "$pkgdesc" \
    
      49			--exec="${_name} %F" \
    
      50			--mimetypes="chemical/x-pdb;chemical/pdby;chemical/x-mol2;chemical/x-mdl-molfile;chemical/x-mdl-sdfile;chemical/x-xyz;chemical/x-macromodel-input;chemical/x-vmd" \
    
      51			--categories="Science;Chemistry"
    
      52	cd "${srcdir}/${_name}"
    
      53	# suppress non-zero exit code that breaks makepkg
    
      54	sed -i -e '/sys.exit/ s,2,0,' setup.py
    
      55	# setup script PEP 517 compatiblitiy is broken
    
      56	local site_packages=$(python -c "import site; print(site.getsitepackages()[0])")
    
      57	sed -i -E '/def (finalize_options|make_launch_script)/a \        self.install_libbase="'$site_packages'"' setup.py
    
      58}
    
      59
    
      60build() {
    
      61  cd "${srcdir}/${_name}"
    
      62  python -m build -wn
    
      63}
    
      64
    
      65package() {
    
      66	install -Dm0644 -t "$pkgdir/usr/share/applications/" "${srcdir}/${_name}.desktop"
    
      67	install -Dm0644 -t "$pkgdir/usr/share/pixmaps/" "${srcdir}/${_name}.png"
    
      68    cd "${srcdir}/${_name}"
    
      69	python -m installer -d "$pkgdir" dist/*.whl
    
      70	install -Dm0644 -t "$pkgdir/usr/share/licenses/${_name}/" LICENSE
    
      71}
    
      72

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2