qgraf

maintainer zenAmp · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is fetched from qgraf.tecnico.ulisboa.pt, which is the official upstream server for the QGRAF Feynman diagram generator maintained by Paulo Nogueira at Instituto Superior Técnico (Lisbon). The anonymous:aur@ credentials are simply HTTP Basic Auth used as a lightweight access gate on the official project server — this is a known pattern for this specific package. The sha256sum is hardcoded, so even if the server were compromised, a tampered tarball would be detected. The build compiles a single Fortran source file (qgraf-$pkgver.f08) with gfortran, which is standard practice. No binaries are downloaded pre-compiled; the compiled artifact is produced locally. The only concern is that the credential-gated URL is slightly non-standard, but it points to the legitimate upstream host and the checksum provides integrity verification. This is sloppy/non-standard packaging (embedding credentials in the URL) but not a genuine supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The source is fetched from qgraf.tecnico.ulisboa.pt, which is the official upstream server for the QGRAF Feynman diagram generator maintained by Paulo Nogueira at Instituto Superior Técnico (Lisbon). The anonymous:aur@ credentials are simply HTTP Basic Auth used as a lightweight access gate on the official project server — this is a known pattern for this specific package. The sha256sum is hardcoded, so even if the server were compromised, a tampered tarball would be detected. The build compiles a single Fortran source file (qgraf-$pkgver.f08) with gfortran, which is standard practice. No binaries are downloaded pre-compiled; the compiled artifact is produced locally. The only concern is that the credential-gated URL is slightly non-standard, but it points to the legitimate upstream host and the checksum provides integrity verification. This is sloppy/non-standard packaging (embedding credentials in the URL) but not a genuine supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("http://anonymous:aur@qgraf.tecnico.ulisboa.pt/links/$pkgname-$pkgver.tgz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Magnus Schaaf <magnusschaaf plus arch at gmail dot com>
    
      2pkgname=qgraf
    
      3pkgver=3.6.10
    
      4pkgrel=1
    
      5pkgdesc="Feynman diagram generator for various types of QFT models"
    
      6arch=('x86_64')
    
      7url="http://cefema-gt.tecnico.ulisboa.pt/~paulo/qgraf.html"
    
      8license=('LicenseRef-qgraf-license')
    
      9depends=('glibc' 'gcc-libs')
    
      10makedepends=('gcc-fortran')
    
      11source=("http://anonymous:aur@qgraf.tecnico.ulisboa.pt/links/$pkgname-$pkgver.tgz")
    
      12sha256sums=('6d4b5c6eb97de1942b824d80b8cb454dd77667492d0001e3bf21e761c5702194')
    
      13
    
      14build() {
    
      15    sed -n 's/^!//p' "$pkgname-$pkgver.f08" > LICENSE
    
      16    mkdir -p fmodules
    
      17    gfortran -o "$pkgname" -O2 -J fmodules "$pkgname-$pkgver.f08"
    
      18}
    
      19
    
      20package() {
    
      21    # license
    
      22    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      23    # documentation
    
      24    install -m644 -Dt "$pkgdir/usr/share/doc/$pkgname/" *.pdf
    
      25    # data
    
      26    install -m644 -Dt "$pkgdir/usr/share/$pkgname/" *.dat *.sty phi3 qcd qed qedx
    
      27    # binary
    
      28    install -Dm755 "$pkgname" "$pkgdir/usr/bin/$pkgname"
    
      29}
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2